StealC 深度静态分析 (f3aa7c12) | High Tehdit

Derin Statik Analiz — StealC | Tehdit: high

文件 Kimligi

SHA256	`f3aa7c12cd3ea1338522720d746902747e75f1094aff964ba2b6417ca57e876f`
MD5	`09335a94e66e63edf675f2f8cfef5104`
SHA1	`4110a19cb96650821f8922bbfb61526795280b28`
大小	1609953 byte
Tur	/opt/ksentinel/samples/b9505282931ce70307a14689daf7767ba1124113c24c7e174499bb533
Derleme	未知
Packer	UPX

C2 Adresi: Sifrelenmis/obfuskeli config (statik analizle cozulemedi)

Yetenekler

Tespit edilemedi (obfuskeli)

SMTP Konfigurasyonu

"J4tO:
otO:\

Gelistirici Ipuclari

PDB Yolu: bash: -c: line 1: syntax error near unexpected token `|' bash: -c: line 1: `grep -oiE '[A-Za-z]:\\Users\\[^\\]{2,30}\\[^

Email: 9c@o.Ux

Telegram: @3puOLj @DIfY @dO4lO @GmL8 @iJfx

PE Analizi

Binwalk / Packer

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zip archive data, encrypted compressed size: 16

家族 Tespiti

String kaniti bulunamadi (sifrelenmis/obfuskeli).

StealC — 恶意软件档案

StealC, 2023 yilinda ortaya cikan Go (Golang) tabanlı bir MaaS infostealer ailesidir. Vidar ve Raccoon kaynak kodundan ilham alinarak gelistirildigi dusunulmektedir. 30+ tarayici, kripto cuzdan, FTP istemcisi, email ve Discord/Telegram token hedefler.

恶意软件类型

Infostealer

编程语言

C2协议

HTTP

目标系统

Windows

技术细节

C dili, HTTP POST C2, browser stealer (Chromium/Firefox), kripto wallet stealer (50+ tarayici eklentisi), Telegram stealer, Steam, Discord token stealer, fingerprint modulu

能力与行为

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

IOC列表 (5 个指标)

IOC — StealC

# 
4110a19cb96650821f8922bbfb61526795280b28

# SHA256
f3aa7c12cd3ea1338522720d746902747e75f1094aff964ba2b6417ca57e876f

# MD5
09335a94e66e63edf675f2f8cfef5104

# FILEPATH
bash: -c: line 1: syntax error near unexpected token `|'

# FILEPATH
bash: -c: line 1: `grep -oiE '[A-Za-z]:\\[^\s\"'\'<>|*?]{5,150}' /tmp/all.txt | grep -viE '(msbuild|nuget|packages|Microsoft\.NET)' | sort -u | head -10'

类型	值	备注
	4110a19cb96650821f8922bbfb61526795280b28
sha256	f3aa7c12cd3ea1338522720d746902747e75f1094aff964ba2b6417ca57e876f
md5	09335a94e66e63edf675f2f8cfef5104
filepath	bash: -c: line 1: syntax error near unexpected token `\|'
filepath	bash: -c: line 1: `grep -oiE '[A-Za-z]:\\[^\s\"'\'<>\|*?]{5,150}' /tmp/all.txt \| grep -viE '(msbuild\|nuget\|packages\|Microsoft\.NET)' \| sort -u \| head -10'

StealC — 查看完整档案 →

C2服务器 (该家族共有 4 台已记录服务器)

地址	类型	端口	协议	状态	国家
www.pakistani.org	domain	—	HTTP	active	—
45.87.152.64	ip	80	HTTP	inactive	NL
185.174.137.219	ip	80	HTTP	inactive	RU
godebugs.Info	domain	—	HTTP	inactive	—

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签

stealcstatik-analizhighc2iocpe