Extracted

• • Target

    b003fca8539284507976b319201efd5e.exe

  • Size

    221KB

  • MD5

    b003fca8539284507976b319201efd5e

  • SHA1

    a5b23388a47a3530e81b4b32e173526c20b55e88

  • SHA256

    22d3277898429127b4566110be173684bdcb40773cac030bc4818dfd4677a3b0

  • SHA512

    21e12da259f8b05d112b8d705c67959b9642c94cd3ef59429689eb74ad54202a52dfdb29ab4d16df8173fb140b904e58ebf19d33073d6ba01ad9c4955b75e2ac

  • SSDEEP

    3072:6oYWKJDW7QH3apiqevYo8n7BhUygUkK8gCE+Cs9P1oB6n:Z1pY3agqebuthUyRky+rsB

  Score

  10^/10

  stealcdiscoverystealerspyware

  • Detects Stealc stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2