Overview

overview

10

Static

static

10

Creal.exe

windows10-1703-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Creal.exe

  • Size

    13.4MB

  • Sample

    240703-dagwxatdpa

  • MD5

    59a8a36217724a81fef8f48fa309b4e0

  • SHA1

    2178054dd790434106ba34a79cb60ffee6058c97

  • SHA256

    216be8b08e0d04bb4dae8d3491b28206e33a86878abedee93b8fdffe103cdeb2

  • SHA512

    e73cb3642b5195dcb62e40ec6616924be13c9f4f6d8ca1963454fab345c94d3ada96d92e877ce95c5db5a9a197b1a5113f1ea3c49d2bf5c5429907752c42e2ac

  • SSDEEP

    196608:PM/EkwAc7wuLIoBA1HeT39IigwE1ncKOVVtd97wrhkiLtQGN+j9WBiuT6Ww4/:KEkwAcsIq1+TtIiFg0VBxwSS6bjEA6

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      Creal.exe

    • Size

      13.4MB

    • MD5

      59a8a36217724a81fef8f48fa309b4e0

    • SHA1

      2178054dd790434106ba34a79cb60ffee6058c97

    • SHA256

      216be8b08e0d04bb4dae8d3491b28206e33a86878abedee93b8fdffe103cdeb2

    • SHA512

      e73cb3642b5195dcb62e40ec6616924be13c9f4f6d8ca1963454fab345c94d3ada96d92e877ce95c5db5a9a197b1a5113f1ea3c49d2bf5c5429907752c42e2ac

    • SSDEEP

      196608:PM/EkwAc7wuLIoBA1HeT39IigwE1ncKOVVtd97wrhkiLtQGN+j9WBiuT6Ww4/:KEkwAcsIq1+TtIiFg0VBxwSS6bjEA6

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks