Overview

overview

10

Static

static

10

creal.exe

windows7-x64

7

creal.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    creal.exe

  • Size

    13.3MB

  • Sample

    240212-r3z5vaaa53

  • MD5

    9ef498e3313cca5b7e333429b4df8fa1

  • SHA1

    a50e0a79b24bc5dacc3121458a73288c51028acb

  • SHA256

    699fbefa4676023e67ca6780b6b72a091c3cfae26966d4ff97736c6cb2cedc38

  • SHA512

    93d0cef2056854d13c7b20a994ed81e81b57dafa4911c71307a22c3d6612abf98f2ae9310bbb4c560a6597fcfe66d50524d0195709c704c403685fa63d1f5576

  • SSDEEP

    393216:ZEkQExJDBfFZNRwSo6ivaCncpH07mKfjN0Ft:Zo4BfFXR66iiCngH07rK

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      creal.exe

    • Size

      13.3MB

    • MD5

      9ef498e3313cca5b7e333429b4df8fa1

    • SHA1

      a50e0a79b24bc5dacc3121458a73288c51028acb

    • SHA256

      699fbefa4676023e67ca6780b6b72a091c3cfae26966d4ff97736c6cb2cedc38

    • SHA512

      93d0cef2056854d13c7b20a994ed81e81b57dafa4911c71307a22c3d6612abf98f2ae9310bbb4c560a6597fcfe66d50524d0195709c704c403685fa63d1f5576

    • SSDEEP

      393216:ZEkQExJDBfFZNRwSo6ivaCncpH07mKfjN0Ft:Zo4BfFXR66iiCngH07rK

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks