Overview

overview

10

Static

static

10

Creal-Stea...eal.py

windows7-x64

3

Creal-Stea...eal.py

windows10-2004-x64

3

Creal-Stea...er.bat

windows7-x64

1

Creal-Stea...er.bat

windows10-2004-x64

1

Creal-Stea...der.py

windows7-x64

3

Creal-Stea...der.py

windows10-2004-x64

3

Creal-Stea...ll.bat

windows7-x64

1

Creal-Stea...ll.bat

windows10-2004-x64

1

Creal-Stea...on.bat

windows7-x64

1

Creal-Stea...on.bat

windows10-2004-x64

8

Creal-Stea...unk.py

windows7-x64

3

Creal-Stea...unk.py

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Creal-Stealer-main.zip

  • Size

    385KB

  • Sample

    240310-gdt77adg81

  • MD5

    d99407d0c43b6082c890a26f331b0201

  • SHA1

    4e2022d57949fe3a5634fd3b56731287646b87c3

  • SHA256

    fce4891d0ca542d32448ba0d79fe853654cbd7eeb81768ac36cb0316609ea8a0

  • SHA512

    7a103a34e5fed4dc89a630d999d4e9a9c6327dc2305c4b54e3db519577a01c87f355170e831399dcba83d6348b68ebedb6aba9132dd787c7bf5a1c12ea2a92e5

  • SSDEEP

    12288:jRiCtqedNidWy+IIDcDBQHoJRdfgVffG9JZ6QDe:NBt5OV+3mndfgVff4ZpDe

Score
10/10
crealstealerdiscoverypersistence

Malware Config

Targets

    • Target

      Creal-Stealer-main/Creal.py

    • Size

      42KB

    • MD5

      fea991e39b09a902a852c6937ea2c4da

    • SHA1

      9ac29c2b31dabed65e7a716587840e2a1815cd42

    • SHA256

      baa6a5816056c73f157f72d0cc3875832033eeeb261049374567a85a83d0253a

    • SHA512

      6344376db55cc871f27b380862f2648f90d9ef4f0c37e83ddd64ed011c68c67c55cee50d9536414e7bf88d7a7bb645fb5648c08339dfddeee98d82af98fd4bc5

    • SSDEEP

      768:Q1DAWRknXeihOCSlqLCxzAj6VppDPi7WR:Q1kWRknhhFSQLhmVpoWR

    Score
    3/10
    behavioral1behavioral2

    • Target

      Creal-Stealer-main/builder.bat

    • Size

      56B

    • MD5

      001b0fde2e65ae4f8fa280ccdb746c93

    • SHA1

      6f3ad8b217f090c0a37ae21ee6f0065e58635771

    • SHA256

      06c326475f195707960159fd70e759bbba1f8b638fb4f749bad68fbb0b728aa2

    • SHA512

      de065f3c04647f572bc8436c5aacd400956954bec23dcad8db2ddfe2689c37bb2ba0221e84ce11e826c9f9efc43d1782ccd28e76c9c25fba3e277f1b694c781a

    Score
    1/10
    behavioral3behavioral4

    • Target

      Creal-Stealer-main/builder.py

    • Size

      4KB

    • MD5

      98ab58d0db2f492feb701fcffb4c0642

    • SHA1

      3adb54282894658a69031118f25c6d82e9e563e6

    • SHA256

      cc6fd730887c8c5e3cf12f301d36f0ef5fe16c306b49cd69fd265c20c0a12a41

    • SHA512

      c4e113a59c16d9f1147a64c66347e8761abf989be02a80dc668708b6c6d12143cf7637c9ea0b0ff2754d586db69ffa95e5183e6029c9cda9af2458b8d9696046

    • SSDEEP

      48:SUZ8IzsW071hzsGU0h+zgEC5PsOq7lm+7hUhTlvJd4Hhm8bhX4+V8JF4RizPO:SUZ8ewFnJYb9wCo8z2Jaiq

    Score
    3/10
    behavioral5behavioral6

    • Target

      Creal-Stealer-main/install.bat

    • Size

      161B

    • MD5

      6e850049ee08bf9ed50bfdee6e6934c5

    • SHA1

      4fcf058207a8c7acbbb08a8c752dc803c66c6963

    • SHA256

      65df947f76e4c904718c25a0a318ca6f35bdd2328c818ee3b09d75f0f43fa710

    • SHA512

      3cd1a3098791670756f8151a952b12183e8d74aac28809afb3433565b40dc2d583648d479ab064345c9409f7cb534504ec471cfdfd884a1d420341c975d55609

    Score
    1/10
    behavioral7behavioral8

    • Target

      Creal-Stealer-main/install_python.bat

    • Size

      687B

    • MD5

      821f007d1c56bb3f4511bab928ce8f63

    • SHA1

      a22b0d76f5ef0e145629dded82e195486675774a

    • SHA256

      434f9d4a2a7a5088aa393b47ad8e957a15481cd3078f10b3c0f7ec6fe5f497c2

    • SHA512

      f1db8db20e25d8d06828ead22e70a28411bf32faa7dd14816ef833efe548a046e9383cb51aa100d49555f2cc9c1f74bf10aef871a0e6724da5f96c690770dd4d

    Score
    8/10
    discoverypersistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral9

    • Target

      Creal-Stealer-main/junk.py

    • Size

      5KB

    • MD5

      e796fd742bb555174ee83f3ce4118d0c

    • SHA1

      9b3b86b4614ee9e64cd836aa77f1fc43102df026

    • SHA256

      3c9881a0bf734894ca5603e5f5c63e84111b9f3415fb27c69d80cb3f54be6ec5

    • SHA512

      3106f4593989a13673bebf847d958a3359f930e36bfda7cd1e0c91d94e2e0d461d5e0250c27f3475e0ffd58c5ad8e6338315e91e985c31390fd8839e20ef0943

    • SSDEEP

      96:hj1UM1piEsD1UM1piEFb1UM1piEsD1UM1piEFb1UM1piEsD1UM1piEFR:V1v1piZ1v1pi+b1v1piZ1v1pi+b1v1pA

    Score
    3/10
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks