Extracted

• • Target

    61104e2ae6c12556124680a067a454628e71a9e33e2958088c4e392541099e9f

  • Size

    252KB

  • MD5

    3fb912db2845b9f2c25a405056ada1f5

  • SHA1

    de83fd3c4422b4432768073c9cd9faf4662b308e

  • SHA256

    61104e2ae6c12556124680a067a454628e71a9e33e2958088c4e392541099e9f

  • SHA512

    a595553be3b7f4f03a094e4b439a0dff41748be7f2f53827a635e989590b21d2064f18babbfabf50df43fd43983f4353fa2c73da8a8ea16b6e83a604790896d8

  • SSDEEP

    6144:WIcDMBDMpPCrJTJtyB2Q1Ws5CPpT4ea6F:2DMBgp6r5K8A

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2