Extracted

• • Target

    76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6

  • Size

    400KB

  • MD5

    11e20aa257ca42b9c2542ca924e1a6e8

  • SHA1

    3fdf848f8a6adabd8a22fe15867fb298db79c1e2

  • SHA256

    76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6

  • SHA512

    7c6b46b1e7cc29bd5168f8b9b41a9d64eb6c98fe6f95dedcf6427afe179710f784895a02557b546d97669ce9ad6e471f9d14b9d867607f21ca8e3d272095ae97

  • SSDEEP

    6144:OlcU2rm3BeTtiBlMsHTlI/sCTaldjq5oUT/U3t53s7NJ6T93kAXLO2/Oo8aILP:LU2r+YTotZCYjYNo3tdkO/OxpP

  Score

  10^/10

  stealcdiscoveryspywarestealerupx

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2