crealstealer | fc27206c3753c3600098db372f5a218c2631b228bd7819b179ab0b2ceb54edfc | Triage

Submit
Reports

Overview

overview

Static

static

fc27206c37...fc.exe

windows7-x64

7

fc27206c37...fc.exe

windows10-2004-x64

7

Sharing

General

Target

fc27206c3753c3600098db372f5a218c2631b228bd7819b179ab0b2ceb54edfc
Size

14.4MB
Sample

231215-tf394aefgl
MD5

2780f10ac51846fc57fca9c1fa0a95d6
SHA1

1ac9c629f5ec95de2c6ecc3c91282d87a87cdfc1
SHA256

fc27206c3753c3600098db372f5a218c2631b228bd7819b179ab0b2ceb54edfc
SHA512

f167ba3f7ac3e0c527192055ea5cc83186391077ce1bfa2253af3cf5b5efe645d5ea4f4d79c1f21721e2b1a3f0986e0fe950678c8548e587ba12e7d396fbb018
SSDEEP

393216:hu7L/sQMidQuslSq99oWOv+9fgEgjujn4Tq:hCL0Q3dQuSDorvSYEgjA4T

Score

10^/10

crealstealer pyinstaller spyware stealer

Static task

static1

pyinstaller crealstealer

4 signatures

Behavioral task

behavioral1

Sample

fc27206c3753c3600098db372f5a218c2631b228bd7819b179ab0b2ceb54edfc.exe

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

fc27206c3753c3600098db372f5a218c2631b228bd7819b179ab0b2ceb54edfc.exe

Resource

win10v2004-20231215-en

spyware stealer

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  fc27206c3753c3600098db372f5a218c2631b228bd7819b179ab0b2ceb54edfc
- Size
  
  14.4MB
- MD5
  
  2780f10ac51846fc57fca9c1fa0a95d6
- SHA1
  
  1ac9c629f5ec95de2c6ecc3c91282d87a87cdfc1
- SHA256
  
  fc27206c3753c3600098db372f5a218c2631b228bd7819b179ab0b2ceb54edfc
- SHA512
  
  f167ba3f7ac3e0c527192055ea5cc83186391077ce1bfa2253af3cf5b5efe645d5ea4f4d79c1f21721e2b1a3f0986e0fe950678c8548e587ba12e7d396fbb018
- SSDEEP
  
  393216:hu7L/sQMidQuslSq99oWOv+9fgEgjujn4Tq:hCL0Q3dQuSDorvSYEgjA4T
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Process Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

pyinstallercrealstealer

behavioral1

behavioral2

© 2018-2025

Terms | Privacy