Extracted

• • Target
    6b1dec90cd18e6ec0ca94d71f69c7c08177d76ad96cb629f1f3c7cb36c2be443
  • Size 1.5MB
  • SHA256 6b1dec90cd18e6ec0ca94d71f69c7c08177d76ad96cb629f1f3c7cb36c2be443
  • MD5 07dfa93dd7d8c98c5106d222dd06542f
  • SHA1 91ee67862b5c75d8c49f1a7a7f5ac962d2282c4d
  • SHA512 ba55dd573c5d360db7919abee0bc00e44c43279de406473d2e252c0779d2c60d88f66fd12d849f98c9f469722a33a0e2b117983d0e2fa9f09d4ed89f8da05fc0
  • SSDEEP 24576:1K9MHjif9ydK3gBlsXbvLbLUJ70Uj654koEBETT2TjyAAk:1/jwwdKQl+bH4JbjzzEBETT2T5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdefaultdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2