Extracted

• • Target

    0255bbbc27ded775069d255d1b8c0310ad7a2c0f13695b1c05bf2d4a0bef7c34

  • Size

    2.1MB

  • MD5

    2d2035b21217fa87a9db333368c4f34b

  • SHA1

    cf66aaeb0495c19b3a8b367472ddd4c0e26b42fa

  • SHA256

    0255bbbc27ded775069d255d1b8c0310ad7a2c0f13695b1c05bf2d4a0bef7c34

  • SHA512

    24321bb7f2507780d46f2efc84c27b38e7489833c8947be3f43e8a20ac1c438ed67e87aba99a840f70e2d09250a95ee19b250931b04da868dfa78d90a69201fc

  • SSDEEP

    49152:LEGB3k9i6uZ92ckl5LRYCaB6xPiZYWDUhbr/bDdJDt7os6/Yn:gGFk9mZcXlBRGB6YZY3DDtksjn

  Score

  10^/10

  stealcdiscoverypersistencespywarestealerupx

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2

• • Target

    $PLUGINSDIR/INetC.dll

  • Size

    21KB

  • MD5

    2b342079303895c50af8040a91f30f71

  • SHA1

    b11335e1cb8356d9c337cb89fe81d669a69de17e

  • SHA256

    2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

  • SHA512

    550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

  • SSDEEP

    384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i

  Score

  3^/10
  behavioral3behavioral4

• • Target

    $TEMP/BroomSetup.exe

  • Size

    1.7MB

  • MD5

    eee5ddcffbed16222cac0a1b4e2e466e

  • SHA1

    28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

  • SHA256

    2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

  • SHA512

    8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

  • SSDEEP

    49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK

  Score

  7^/10

  upx

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral5behavioral6

• • Target

    $TEMP/syncUpd.exe

  • Size

    236KB

  • MD5

    cfe0c08561b0b63ae3a515fa185eb3c8

  • SHA1

    6c8e721e70ac1120e5f26039a4c814874d50fae0

  • SHA256

    9d992a181e526a3d3f6a247a0e148fa77b18470282e55b7e821f73b24b7658ac

  • SHA512

    ee221efda932a664b1d8a4e8e0b4e72a06e3e78e10549edf07598697a1960ba0cf5eb52a4cb9d182a621dc0a1a4cef6e0c78ff498ad8c5cb8b725f09d62747fb

  • SSDEEP

    3072:TvuXf0AGrsCqCCvD9ga9/OVtFeLzPj4Z1LbeMDpfM:TjsCqtvDn1OBwKiMd

  Score

  10^/10

  stealcdiscoverypersistencespywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral7behavioral8