Extracted

• • Target

    015da94a48702bde0297911a4872469d9f4851d5067acf3fbbd412cbe82377ef

  • Size

    190KB

  • MD5

    c3cda4284fab6d48c2781c7e78dded15

  • SHA1

    e0e6d1711ba8afcd402f232214a76bf3f9efa7ef

  • SHA256

    015da94a48702bde0297911a4872469d9f4851d5067acf3fbbd412cbe82377ef

  • SHA512

    9a188c5573f9fffcf3f487a40822f857ff0db995ecba5ad4b77ddc88b5964e89c58bc864d7960f77e218a6a159caaeda8d35bdda9712e9d3b2805ca04fb33a53

  • SSDEEP

    3072:IJW9jLf7NyT1TAT2l3NUvtgDtvA2aGjxxkpzeJsV5kZ6q:l9jLzNyT1i43WODJA2TjxupIR

  Score

  10^/10

  stealcdiscoverystealerspyware

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2