exelastealer | 0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665 | Triage

Sharing

General

Target

0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665
Size

10.7MB
Sample

240615-vjjwas1hnk
MD5

3f4f5c57433724a32b7498b6a2c91bf0
SHA1

04757ff666e1afa31679dd6bed4ed3af671332a3
SHA256

0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665
SHA512

cf572ca616b4f4e6e472e33e8d6d90b85d5885fa64d8bca4507450d66d65057efa771f58c31ea13f394fd0e7b0ff2fcaa9d54c61f28b27b98a79c27bc964f935
SSDEEP

196608:mRu4YAJSAfoaqA6U+L5LsSmyYbH6t08RMQcCqcGUIRBw0xvH77Y:2u4YAJSAfoaZ0sSmpH6W8R/RVIc2vH7

Score

10^/10

exelastealer evasion spyware stealer

Malware Config

Targets

- Target
  
  0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665
- Size
  
  10.7MB
- MD5
  
  3f4f5c57433724a32b7498b6a2c91bf0
- SHA1
  
  04757ff666e1afa31679dd6bed4ed3af671332a3
- SHA256
  
  0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665
- SHA512
  
  cf572ca616b4f4e6e472e33e8d6d90b85d5885fa64d8bca4507450d66d65057efa771f58c31ea13f394fd0e7b0ff2fcaa9d54c61f28b27b98a79c27bc964f935
- SSDEEP
  
  196608:mRu4YAJSAfoaqA6U+L5LsSmyYbH6t08RMQcCqcGUIRBw0xvH77Y:2u4YAJSAfoaZ0sSmpH6W8R/RVIc2vH7
Score

10^/10

exelastealer evasion spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Account Manipulation

Create or Modify System Process

Windows Service

Privilege Escalation

Account Manipulation

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify System Firewall

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

exelastealerevasionspywarestealer