Extracted

• • Target

    timeSync.exe

  • Size

    237KB

  • MD5

    ae0792e1f93f7682ce03c8f4f9e2906b

  • SHA1

    7056ade37113830af70ae02fe06184374c06dc90

  • SHA256

    bd0619e369e9f557fa70e19f5447a08a625cec708e14459d53fdb338ecf30305

  • SHA512

    95d09e2679f5bd9c53b5e36e17c013565f9245029d8dfbe4ea22810f6b444c45b5c7e77069d29e3c7e7a1c5d7a098bad1977dbcf6c310c8407278873db1710f6

  • SSDEEP

    3072:fJOKSG+jJx3AdF7mSJief2m1KpEtbUT1nGBvUEtrSWe/qcRbP1XRQ9mtxxgwT:fJOKS/EF7kpGegrmfgIt4

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2