Extracted

• • Target

    file.exe

  • Size

    2.4MB

  • MD5

    e0525803e9e18b3e3a73b6e999b40284

  • SHA1

    f92b719f6e774c35836a582cff902f3f5f54c6a2

  • SHA256

    59d115c4f1a0035301f09d9697f988c7f667d0131582dfa7a28990fc02baa086

  • SHA512

    dbf56d01de700a74c757dee971b146661c93d284590813b7eba336235eb32aae076060f45467a84eb2541db9926a0cdb66af1b8885f7a9c07420ebc58da2c81b

  • SSDEEP

    49152:50qyaLYgipQlIeEk/AuNzOmAhHmjLpyKMATpTaqNo/ZboV:MCNoQlIjk4aOThHMLpiATpTzGxU

  Score

  10^/10

  stealchatediscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2