exelastealer | bc453d4ef66b8f580897308af2cccbebeb2423c008a2b7bcea0483bd021714ec | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

blessed_beta.exe

windows10-2004-x64

Resubmissions

05/07/2024, 21:30 UTC

240705-1cgp9awekp 10

05/07/2024, 21:23 UTC

240705-z8fmdsydlc 10

Sharing

General

Target

blessed_beta.exe
Size

11.2MB
Sample

240705-1cgp9awekp
MD5

cf820817ac61842aa0429fc4b8977ef8
SHA1

8783d4d2f3d1daee97cab7a3e4ea681698732064
SHA256

bc453d4ef66b8f580897308af2cccbebeb2423c008a2b7bcea0483bd021714ec
SHA512

470c23c6d8ff537e524191ac7b0ceffca959162a73e810d45aa06ad0dc6c6b52ed887c270f0cc7f15f0b4251625ff70205dcdd99785914264f775ccaca4e317e
SSDEEP

196608:wXcisRkFC/PAgtSwLRXgWPmpzdhqiUeNvX+wfm/pf+xfdkRpjHKsnzruOZW0D+qI:risHAgt5L1V8dvvX+9/pWFGRBqsnzrul

Score

10^/10

exelastealer evasion persistence privilege_escalation pyinstaller spyware stealer upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

blessed_beta.exe

Resource

win10v2004-20240704-en

exelastealer evasion persistence privilege_escalation spyware stealer upx

windows10-2004-x64

19 signatures

1800 seconds

Malware Config

Targets

- Target
  
  blessed_beta.exe
- Size
  
  11.2MB
- MD5
  
  cf820817ac61842aa0429fc4b8977ef8
- SHA1
  
  8783d4d2f3d1daee97cab7a3e4ea681698732064
- SHA256
  
  bc453d4ef66b8f580897308af2cccbebeb2423c008a2b7bcea0483bd021714ec
- SHA512
  
  470c23c6d8ff537e524191ac7b0ceffca959162a73e810d45aa06ad0dc6c6b52ed887c270f0cc7f15f0b4251625ff70205dcdd99785914264f775ccaca4e317e
- SSDEEP
  
  196608:wXcisRkFC/PAgtSwLRXgWPmpzdhqiUeNvX+wfm/pf+xfdkRpjHKsnzruOZW0D+qI:risHAgt5L1V8dvvX+9/pWFGRBqsnzrul
Score

10^/10

exelastealer evasion persistence privilege_escalation spyware stealer upx
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Account Manipulation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Account Manipulation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

exelastealerevasionpersistenceprivilege_escalationspywarestealerupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.