General
- Target https://cdn.discordapp.com/attachments/1246876705122029608/1247664541236727878/Xylex-V8.1.zip?ex=6660d9a7&is=665f8827&hm=9ce8a30b9cafc1994f7c49dedbabad29d17452b2feb3c6ba08019dd3457913d8&
- Sample240604-3az5xsff77
Score
10/10
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1246876705122029608/1247664541236727878/Xylex-V8.1.zip?ex=6660d9a7&is=665f8827&hm=9ce8a30b9cafc1994f7c49dedbabad29d17452b2feb3c6ba08019dd3457913d8&
Score10/10-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.