Extracted

• • Target
    42f39d07d6b48a178c3453b6db29ac89.exe
  • Size 363KB
  • SHA256 7eda35b2c10d5bbc286d3f446c142758783aea0535b55c9dd42968d35ca202fa
  • MD5 42f39d07d6b48a178c3453b6db29ac89
  • SHA1 7b4039b2c8af8c788474783e37f0e8d8c7ab0f5a
  • SHA512 dd28f526c7ae290c7c058cfef30eed7ad34d235a85601d8ff96e404d6b1504885931fe50e734d79ca4ea4087d4a18fead4cf5984b0e62620b52f8708dc9ee8af
  • SSDEEP 6144:XD+PMb1LmDrxhkF8TGT4+HdS6L0MUbZ3iTkkP2d3UmuDsNeF:z+PMRExqF8T6dr0RZ3q83UmuIN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2