Extracted

• • Target
    98aa50851ae80d3839136955f4e406a2.exe
  • Size 294KB
  • SHA256 095a44fa390ddda2e06a6a6cb0dbc5972aed3867424ecc523978923703b9a720
  • MD5 98aa50851ae80d3839136955f4e406a2
  • SHA1 e2f9440e882c14d3a2867d33cd7b35415393eb24
  • SHA512 84690131dd2b76ae00512777e4e60536ce6c4954842605c4235d4d398c6c5331f660bd1b1c6182eb91f2c755ce15cfdde39c7a2a56f781cde8b641efe6078358
  • SSDEEP 6144:od/8okM4hJ7mjidh67Fp/3rYqcTseFLQYQ8/SZqW8YB:o58okM2JHGFpjYqcRLDEB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2