Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.30262.29900.exe
  • Size 256KB
  • SHA256 7b9e3a1daae553787702cc7245c8aa6d569cbf97a054e6e7a1248c071eb9d7d4
  • MD5 46fa1bba8d146d9e946f7bd7cf3090f1
  • SHA1 345eb9663ecba78173e1c42652439c3f275fcc52
  • SHA512 befd5474bf673047b35b4f581e35714a73238742569a83c7128e4d6581463e5b7e24d0ee656f69c4ba678179052adba367b1617c0756769c807ea5d16769e533
  • SSDEEP 3072:kZVarLBkgSdn9jFjYSWgCZ9jWEHmknrbwKm7rUx07GtX+rB05Yu1yNh:IGBkg8JjYB+EHmUJm7oLl+rB5ey
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2