Extracted

• • Target
    file.exe
  • Size 220KB
  • SHA256 56b20f8eebb0f9ecdd8be61665112fd3ff75d97c037e45bbe1ce74b9d382882f
  • MD5 78851a1c0aab614459b9cefcb02ae832
  • SHA1 7adcd4ff05a5b48ea104d8ced22087529e140311
  • SHA512 7d57cd54fff28446b6ce2e3fac0f0e7d7884debdc6c2d43d7ad6a6956350803cc01400552a359497d295018d82df665027a7621f0aca9ca76b8b981958268c37
  • SSDEEP 3072:kisOLr6z5bz8PlWBw1/yzYs/OAJ7GG8KU4n5A3ZF7xp:rLY1WWBMgEAZGflR3H
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealc8268873659707098636355379426discoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2