Extracted

• • Target

    df78d1b711e9962a318984ef8e824539.exe

  • Size

    642KB

  • MD5

    df78d1b711e9962a318984ef8e824539

  • SHA1

    6c0eb9b29bbb7589ea4c8d4a5a3adb8f1af91cb9

  • SHA256

    d392739ff6d577ce1e207fe9257d951025d61a98a767b304069155942a65b1ae

  • SHA512

    5b77a71b1b945b451a6a8352a180495fe476e07167e0272575858f88333d9f2d8ddb104d390d6877c828aadf3be5f118b0a6f767ed3f03c0733b0bce2a33982a

  • SSDEEP

    12288:JHQ4R78rGcukgmWRjAeQzqtoCldl4Dol9:1HhZcw95jMCloDg9

  Score

  10^/10

  discoveryspywarestealerstealc

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2