exelastealer | 482c560821dff63e878f6a8adf9e900a4e3756bd392ff92d37c135bd62e47de1

General

Target

Updater.zip
Size

10.7MB
Sample

240629-g2xyzssdph
MD5

26827c9792689b74098834a6d8c20aab
SHA1

07e2be92ae5393afcd690fb822130535a6d2c17e
SHA256

482c560821dff63e878f6a8adf9e900a4e3756bd392ff92d37c135bd62e47de1
SHA512

90941280d2260fca8fb5c16b49819dd10d1940936cc5e48bb0b4a1bb0ff692670c85905bb1dee9f44cedd6577df26fc339ce5703eab3c4a4a43c3c00e0483a30
SSDEEP

196608:+ELj55Zei3SoDqxe6j5Wx2XfTmXRroRyc5LmeHH7+O7US1IxwH1/:rdui3FDqNj5FXfyhkRbKeHH7+4pICHx

Score

10^/10

Malware Config

Targets

- Target
  
  Updater.zip
- Size
  
  10.7MB
- MD5
  
  26827c9792689b74098834a6d8c20aab
- SHA1
  
  07e2be92ae5393afcd690fb822130535a6d2c17e
- SHA256
  
  482c560821dff63e878f6a8adf9e900a4e3756bd392ff92d37c135bd62e47de1
- SHA512
  
  90941280d2260fca8fb5c16b49819dd10d1940936cc5e48bb0b4a1bb0ff692670c85905bb1dee9f44cedd6577df26fc339ce5703eab3c4a4a43c3c00e0483a30
- SSDEEP
  
  196608:+ELj55Zei3SoDqxe6j5Wx2XfTmXRroRyc5LmeHH7+O7US1IxwH1/:rdui3FDqNj5FXfyhkRbKeHH7+4pICHx
Score

1^/10
behavioral1 behavioral2
- Target
  
  updater.exe
- Size
  
  21.8MB
- MD5
  
  a3e0a70109eb93263061814afc7020f6
- SHA1
  
  930163ab2c31d4fed8d6d254c434f576849032da
- SHA256
  
  6afef0c45f0a2c0e67740a0c3d6c46c22923ebd86efd7e8d6d0490c691abb724
- SHA512
  
  dae14d2178e4060f9e80ac061fa6d6ccffd812e8d72e05349e79a142f18a4b58ff356399b843692d5003b3f7d29c4ca4ccd9c7190687b877ae7e505e2449bee0
- SSDEEP
  
  196608:vGRltJPArmtSreNvX+wfm/pf+xfdkR0yTlKsnfrwWOtW0DaF1H:WDOqtSQvX+9/pWFGRhAsnfrwWIRajH
Score

10^/10

upx exelastealer defense_evasion evasion persistence privilege_escalation pyinstaller spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral3 behavioral4
- Target
  
  Stub.pyc
- Size
  
  872KB
- MD5
  
  28d98606a7d2a30f67a5aaeb96d7d1e4
- SHA1
  
  efad1e8560d0dd3b21fefa2c671504224998aea9
- SHA256
  
  61d574ffce1ea546c31a6a68d0bfb943b355b3a643c06c9e1b17cbae1637e010
- SHA512
  
  6f40d175595cf5d0729d7d529bf10f1dcd194c33ae1d20e05a186643398deaea9731015a4b1e15f40e77c4ec54b5dc2fa7e2816b1afa4d03cdd76e82b5ce71f6
- SSDEEP
  
  12288:7Nk8Pa3QR3ojyjOAWHfeHpZ4E6+rdYJggiSFCGRln8vkfAL3m/RIPip1ZmBQ:Z9uQR3/CAW/eJZ10iqP/q3CIqp1P
Score

3^/10
behavioral5 behavioral6