Extracted

• • Target

    3ff61ca2f5d065e7b09031ba27eb2a7e4000359d75a788245f12fcf6bba0ae30

  • Size

    175KB

  • MD5

    2ff6ee1ef4ea7c63588e3c904e066cf4

  • SHA1

    85a5d659cdcdd358af7320a39dd129601b9e8c41

  • SHA256

    3ff61ca2f5d065e7b09031ba27eb2a7e4000359d75a788245f12fcf6bba0ae30

  • SHA512

    5d00ea2bbe6384e6f4375210f485b80e8109e4c578775d146423696ce8e6b4beac93d240df329ad443f0b03d13ec46cfdd06e80d52946f662263169fffdb6713

  • SSDEEP

    3072:NwLDaY5OIQfqCanVKeZccMBt1n/W77i5ftMwQx6TN45:uLDf5Yo3ZccMB3nAwQ7

  Score

  10^/10

  stealcdiscoveryspywarestealerbuerloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2