Overview

overview

10

Static

static

3

Setup.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup.exe

  • Size

    9.5MB

  • Sample

    240616-q8rvzszcrl

  • MD5

    a32eb4180ec6957a17eea6fcdc81cbb7

  • SHA1

    d0fd7e6268ba3042f13d5bf1ad0ae633f804cf57

  • SHA256

    044dca6bd58750a5e419054c894494034c71d8d510558d6e1de427c9ff9dc316

  • SHA512

    a4ed51aacd3a1c84257325e65691401e6a86cffb9d91892ab1af02729f6202bd702522a32c9141648c73b120f4bad5fbdda0a1789db31fa1828fb8bd7314d685

  • SSDEEP

    196608:h7qEUIx9mtklz2Jp5UfLuqeNsHFJMIDJ+gsAGKkRwl0BLb:J9h2Jp5MOYFqy+gs1wK

Score
10/10
exelastealerevasionpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      9.5MB

    • MD5

      a32eb4180ec6957a17eea6fcdc81cbb7

    • SHA1

      d0fd7e6268ba3042f13d5bf1ad0ae633f804cf57

    • SHA256

      044dca6bd58750a5e419054c894494034c71d8d510558d6e1de427c9ff9dc316

    • SHA512

      a4ed51aacd3a1c84257325e65691401e6a86cffb9d91892ab1af02729f6202bd702522a32c9141648c73b120f4bad5fbdda0a1789db31fa1828fb8bd7314d685

    • SSDEEP

      196608:h7qEUIx9mtklz2Jp5UfLuqeNsHFJMIDJ+gsAGKkRwl0BLb:J9h2Jp5MOYFqy+gs1wK

    Score
    10/10
    exelastealerevasionpyinstallerspywarestealerupx

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

      stealerexelastealer

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks