stealc

General

Target
27634d8ac8758c32b829c18aed415075.exe
Size 2.0MB
Sample240220-eb7pdsae2x
SHA256 0effe718a91a56be8af1a21d673a6c670adeae79054fa3eb9d7394f791c6a105
MD5 27634d8ac8758c32b829c18aed415075
SHA1 a89f6213c2fd69aa57d6091f8ed550b1e1a7bae9
SHA512 115563e55def90fcf60f6b02f2588259ebd7d3e840a5c133479c92817ece242be724746159122d832d3a303c0e3e5f80e0e5d5da44b6fd61ce7b73dec64e477e
SSDEEP 49152:ChUF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAub:CaFdFWINS/NF9gpMR5oEfS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes

url_path
/3cd2b41cbde8fc9c.php

Targets

- Target
  27634d8ac8758c32b829c18aed415075.exe
- Size 2.0MB
- SHA256 0effe718a91a56be8af1a21d673a6c670adeae79054fa3eb9d7394f791c6a105
- MD5 27634d8ac8758c32b829c18aed415075
- SHA1 a89f6213c2fd69aa57d6091f8ed550b1e1a7bae9
- SHA512 115563e55def90fcf60f6b02f2588259ebd7d3e840a5c133479c92817ece242be724746159122d832d3a303c0e3e5f80e0e5d5da44b6fd61ce7b73dec64e477e
- SSDEEP 49152:ChUF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAub:CaFdFWINS/NF9gpMR5oEfS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

stealc discovery spyware stealer
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
- MD5 40d7eca32b2f4d29db98715dd45bfac5
- SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
- SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
- SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $TEMP/BroomSetup.exe
- Size 4.7MB
- SHA256 50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503
- MD5 5e94f0f6265f9e8b2f706f1d46bbd39e
- SHA1 d0189cba430f5eea07efe1ab4f89adf5ae2453db
- SHA512 473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd
- SSDEEP 49152:90oSiZ63YBmS9+rCgpvH8la0ZxRh+caGnj8HEQUhexTUT+1d/2/Tbt:0Ula0cGwXUheabt
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6