Extracted

• • Target

    3045545357b095b5e32bf2d338ec052cf035d88ec6d2d.exe

  • Size

    267KB

  • MD5

    34ef5b293fc862e20476c63ac9b301a0

  • SHA1

    486d3e1d2622f11ff0ae15fd7a7246dd7a45308a

  • SHA256

    3045545357b095b5e32bf2d338ec052cf035d88ec6d2ddd06ce545eaa7eea573

  • SHA512

    7dc1d7e8223a265a1237d1d962adbdc77348c1017d378d8c1736f70dd1aa58339b9f51eee143f5ca9496fd82c85c99a16a9ce21d3838de876c1dc6dc444560c2

  • SSDEEP

    3072:/nWc7smXZcIM9/5E6H6NBTaDgpXVDCe5uY8gsGRimNZ6Zs:vWcpXZ3MB5tuTasDD558ERirZs

  Score

  10^/10

  buerstealcdiscoveryloaderspywarestealer

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2