Extracted

• • Target
    cfba5b074e14544b7aa021cc03b2bdc5.exe
  • Size 311KB
  • SHA256 feb2b1ce0e18c4027700476d3e9549dcbc5820ee0087d1cc6897969ddf49e6f8
  • MD5 cfba5b074e14544b7aa021cc03b2bdc5
  • SHA1 10fb1b96221731f8de443d098f02d2983017a6cf
  • SHA512 98a54cc7c5d28c5f4e1afd1f16c4b33171a060f3377d5969c3e47a1a4b7bf21c5e3797be9f8cfc0670c81f952d440f90c671eafa56e0aea1ad1d587a153355b2
  • SSDEEP 3072:Y77/E5DLJ9GYnJF7oezcy7UEP6Bqhiapfnnydguj0UxBZfBjdGlb69af:K/E79GYnrojy7UhIhVUgNUxBPJGp69a
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2