Overview

overview

10

Static

static

10

Creal.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Creal.exe

  • Size

    9.1MB

  • Sample

    231201-z7rm9sgc68

  • MD5

    b48d964dc5c103e6507557812427e236

  • SHA1

    e13c5ea86dae37739328e908450fa69178ad42b5

  • SHA256

    ec06426cd47daf889d4ef824d6a9375ed266d033b84ce320b3b880322742f3dd

  • SHA512

    2e7d46dc812a779038bd9060b309c352259622e49edeb7e08b35b385af63e62ec4450adbc8128e9e1999f9e2b133d2992062922053fc6d7746db8339661a85ab

  • SSDEEP

    196608:wMyhInrn61W903eV4QRItpDjIIAcwDIlaUGcRP5vvk9LIi/+:uhurnwW+eGQRg9jocBGcqkh

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      Creal.exe

    • Size

      9.1MB

    • MD5

      b48d964dc5c103e6507557812427e236

    • SHA1

      e13c5ea86dae37739328e908450fa69178ad42b5

    • SHA256

      ec06426cd47daf889d4ef824d6a9375ed266d033b84ce320b3b880322742f3dd

    • SHA512

      2e7d46dc812a779038bd9060b309c352259622e49edeb7e08b35b385af63e62ec4450adbc8128e9e1999f9e2b133d2992062922053fc6d7746db8339661a85ab

    • SSDEEP

      196608:wMyhInrn61W903eV4QRItpDjIIAcwDIlaUGcRP5vvk9LIi/+:uhurnwW+eGQRg9jocBGcqkh

    Score
    7/10
    pyinstallerspywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks