Extracted

• • Target

    5b8615896e85dd6af58f2d907f1653bc.exe

  • Size

    323KB

  • MD5

    5b8615896e85dd6af58f2d907f1653bc

  • SHA1

    6ba8e7da63c54173c3f4fbf06c783562eb43d813

  • SHA256

    3161e8351ef07f9062f67505f0a875924269e0098cb95075084a4f59e8c2e988

  • SHA512

    3d65986e4e1f5d0110741ac877d04658c13d58132138e6f9ed0bec5ca8768288690a372a9b81a2e906f74c1623247aae5e96f2aa8a846b9b4b19868e1fe0c3f3

  • SSDEEP

    6144:Tm6qwi5Uh3UnQagtkTkrIwcdPXhaNTagOPnPfewt5/:a6qwi5Uh3MCePPdXMANne

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2