Extracted

• • Target

    c9ea3ac3016093a34f864a52b854e01d655be9f1848fc6de098c79a3d560fc19.exe

  • Size

    240KB

  • MD5

    79862d1e71e51ca677b035f3be29c062

  • SHA1

    15f2769a04073121821f9221a051c155f11ac8cf

  • SHA256

    c9ea3ac3016093a34f864a52b854e01d655be9f1848fc6de098c79a3d560fc19

  • SHA512

    f7eb3f556209b0b52c8139c5d65e812f583be35ee2bd3903e957aeb56e0e74c7e00a8d98e8343e3a6c4b9342f9e56095a46f3fca2c6167c93f7d931288461818

  • SSDEEP

    3072:WiyROOL6CncmaKNyg+HkRaehoWAF75V1hGycABjfiSRP9qr03M:Wb0OL6o1+HkJoFFP1hGycABjfJ9ql

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2