Extracted

• • Target

    9ec2e9f63019496c7974d1434c3040cbb89164fa02d39aa698376ac3067530c1

  • Size

    403KB

  • MD5

    eb9ff03087153fed10ce24f9be84dad1

  • SHA1

    620dd38967b5556d0c8612c652b1215ea6fc34dc

  • SHA256

    9ec2e9f63019496c7974d1434c3040cbb89164fa02d39aa698376ac3067530c1

  • SHA512

    e7404de8e92cfc34f5f4bfa8d5d8f155b090bff05a8f1af92915600d2e392e25f58f8f186c7afba7260c35a7b82a593029efb2271506b40956e03ee90375c859

  • SSDEEP

    6144:J84ZTIPSC0Pob2+LCR1CSq84CgRgXWTd3tnnYPR40J22Z3fZI/tDgogE1:24lSSnoFLl84rgXm9nYnVv2hgogE1

  Score

  10^/10

  stealcdiscoveryspywarestealerupx

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2