Extracted

• • Target

    4f0b695f6bfdc32e70fb0dfad45aba873822f679596ec66a70fd87e90f46f872

  • Size

    431KB

  • MD5

    32dd40dca11c7997236129f6b53f52d1

  • SHA1

    a4fedb22042474ba3ca706c744b1dd4ec1da1b6d

  • SHA256

    4f0b695f6bfdc32e70fb0dfad45aba873822f679596ec66a70fd87e90f46f872

  • SHA512

    b956d8e3ffda65ee60da0b41cf4c53a0ba0e0e4502621eb98a332d1f1d694d6c14f8e989994f9fbc0d0ed61426796887ad2a5d744499979cff2763c5799415a2

  • SSDEEP

    6144:rmvZ1h6GE0+qJ8ET7z8i8pMbNcYwnrqXzxM4aDj2ZEsUoKN+639RXU:SvfsGEQG4v8jMbenrezK4aD7oK/NxU

  Score

  10^/10

  stealcdiscoveryspywarestealerupx

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2