Extracted

• • Target

    SecuriteInfo.com.Win32.DropperX-gen.31232.1531.exe

  • Size

    280KB

  • MD5

    d6803baa9bb7388f379e6286521882db

  • SHA1

    63ea3f5558ac9e5ad61fac7710d8301284dace4e

  • SHA256

    21bc9284cc3a78d74045780b99fe065c7a5170c5f25b74fd948cb08e8fa90fcf

  • SHA512

    4701c743d706f56d7519805f58e5314015d83d75978fdd333c46f6a651876f2f79960b8716a75a0efe8496de85d1cd75abba38dda66bbdc258c9fe14152a38c3

  • SSDEEP

    6144:A45RW6ILF3YX78gJaayjOFjG6jPk2MSl:AsRWBE78gJ1yjwrk+

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2