Extracted

• • Target
    be7cab4f62e17b7fc80b960644637bc0b014fe526c39d5103890345eaba3fed2
  • Size 2.0MB
  • SHA256 be7cab4f62e17b7fc80b960644637bc0b014fe526c39d5103890345eaba3fed2
  • MD5 0f86df0443fdc92dbcef78add7601663
  • SHA1 76f257fcbd8cbfbc4a22b7ee47a6984c9d2ba273
  • SHA512 3239e97e1bf6a8e856a25fa62375a0ed93f4fe3ca51760437565ea7b29651bc683b8b991818bb74a731eb02af36fb9a3961f01dcbfe315d8728f554b807301f8
  • SSDEEP 24576:L+2/6wyqDKhBOfI7IkmORbrjwUK6e2et+cV9+/a2fGRwpgdjoKirBhsCjTsYcOOO:L+qep7YORvxDcV0/a2+SGyFrd6I
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdiscoverypersistencespywarestealerupx

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2
• • Target
    $PLUGINSDIR/INetC.dll
  • Size 21KB
  • SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
  • MD5 2b342079303895c50af8040a91f30f71
  • SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
  • SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
  • SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4
• • Target
    $TEMP/BroomSetup.exe
  • Size 1.7MB
  • SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
  • MD5 eee5ddcffbed16222cac0a1b4e2e466e
  • SHA1 28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
  • SHA512 8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
  • SSDEEP 49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  upx

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5behavioral6
• • Target
    $TEMP/syncUpd.exe
  • Size 200KB
  • SHA256 13cd1152a19fdac6581cac2bd822f34bd3026ea1783ff231e299b6d28c046a6a
  • MD5 c722591f624fb69970f246b8c81d830f
  • SHA1 85516decea5d6987bebe39cbadf36053beaf4bb0
  • SHA512 822584c5c8a0813af4d845e80919776c71a43464ab719d1c303ebaae6a8ed47763183566bedc9be2e8c44de8ee6fd62d1e12be471e5d5c73ae4b1dcdaa34a908
  • SSDEEP 3072:8PDOu5suCmavnBRsuP6GTdbB27zP6FtHPUxX1GOL3+:455zaPBRPPj27uPH8jzu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdiscoverypersistencespywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral7behavioral8