Extracted

• • Target

    3d07b09f83f2fc5dcb7f2429cac9a37160181da77df5a429e37b98dd685f239f.exe

  • Size

    352KB

  • MD5

    a74811b7e2d71612463144c69c0ca7e2

  • SHA1

    900132a2213f70aed06e9982e47cfdcc8964b710

  • SHA256

    3d07b09f83f2fc5dcb7f2429cac9a37160181da77df5a429e37b98dd685f239f

  • SHA512

    c4c5bef04693f000ae1f45d2a2d28f67609f36a635464d5025a50b939eaf9cc8d7766355990847f5679375f3d4b760e035dd92914f754ae64df6923da1cecebe

  • SSDEEP

    6144:IsCv/QNuZNjDPp9XC2Fgd6dwiJLR8ATGb5gBJYgEltzK5d5Sw+tuhdZUui/EO:I/+uZNjDPNGeR85+YgEf25CtuhLi/EO

  Score

  10^/10

  stealccuapfssdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2