exelastealer | ed8d19c843f0c321d9ceb1201d78d9ded4f8685705706b620a250e3ea59adeb9

General

Target

Electron V3.rar
Size

37.0MB
Sample

240718-fz76hawgpk
MD5

ca43b33e3602b32d40503b05fde426e5
SHA1

7f6e18698426f87f317bec0b34824f73309613a7
SHA256

ed8d19c843f0c321d9ceb1201d78d9ded4f8685705706b620a250e3ea59adeb9
SHA512

35108b0921ac03defb467ca9e35948b8826ac323c6daeb5b82035bd916439f236703ffbff1c00ab14cfbbd020e6785b5f60c80ad8879ca18da8753177e8abdf9
SSDEEP

786432:k/wnn/givzGoxUj0qgICFcaYhZMYe8nxMBjixE7Itvbw9nmHznx/ksiZ+y:eGn//GZSYfxnNxby9mD+pMy

Score

10^/10

Malware Config

Targets

- Target
  
  Electron V3.rar
- Size
  
  37.0MB
- MD5
  
  ca43b33e3602b32d40503b05fde426e5
- SHA1
  
  7f6e18698426f87f317bec0b34824f73309613a7
- SHA256
  
  ed8d19c843f0c321d9ceb1201d78d9ded4f8685705706b620a250e3ea59adeb9
- SHA512
  
  35108b0921ac03defb467ca9e35948b8826ac323c6daeb5b82035bd916439f236703ffbff1c00ab14cfbbd020e6785b5f60c80ad8879ca18da8753177e8abdf9
- SSDEEP
  
  786432:k/wnn/givzGoxUj0qgICFcaYhZMYe8nxMBjixE7Itvbw9nmHznx/ksiZ+y:eGn//GZSYfxnNxby9mD+pMy
Score

3^/10
behavioral1
- Target
  
  Electron V3/ElectronV3.exe
- Size
  
  37.2MB
- MD5
  
  35ff4b8cfa381b8c421d7f4278e5eea2
- SHA1
  
  c686165b7dd71d48433e5298be2fec7e6c6b64dd
- SHA256
  
  fec6107f08e216d76cf05ee65f1894de778b386b61cb6c459f6c0f6657de2c6f
- SHA512
  
  0f31fc013005b38cb0be2cd33780627364e4e70683670bbc0ab3ffd154c229b97dacffc895c503a4c8689f4d627ec5e6b3e69394871349ccd6c64977d11b4e0e
- SSDEEP
  
  786432:y9OQxKKj1YqIdryuIjHNOgi5EMkhqN+NhAiJ1piKvIeVrsgv3FdbfitHJblxb:EOQAKjSqMhIjHNm5Dkq4bAodvIeVrhdO
Score

10^/10

exelastealer defense_evasion evasion persistence privilege_escalation spyware stealer upx
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral2
- Target
  
  loader-o.pyc
- Size
  
  281KB
- MD5
  
  dfb79ab8133b2c42bddfd1fab4a8923b
- SHA1
  
  5c1dedde56e6a19ebc971d6d7eef09b3924ce6cb
- SHA256
  
  a44f854ce44451a188f7c7dc9a4480978e7bee6cc503077b442419c0dfca7b47
- SHA512
  
  fca34a88797a13857cc0514fa0bf11ae0d3a2898c0a9296c2c5f4f7946dce86ae4f43bb0ca4f08c27c6b3cbf39e83372b5b8a24fe8b07196561b219d14987d00
- SSDEEP
  
  1536:aaqk4bvv85VGtCBrEjvF4ponc4TV4lafHjcmY6mwxHTSoni9edpw2YRxFfSLoqou:aaUbvkaKr4FCeTOVxHWup5aOEg2h
Score

3^/10
behavioral3
- Target
  
  Electron V3/bin/agree.txt
- Size
  
  4B
- MD5
  
  b326b5062b2f0e69046810717534cb09
- SHA1
  
  5ffe533b830f08a0326348a9160afafc8ada44db
- SHA256
  
  b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
- SHA512
  
  9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de
Score

3^/10
behavioral4
- Target
  
  Electron V3/scripts/Inf Yield.txt
- Size
  
  98B
- MD5
  
  727b09f7da97df9cf7eb1bbe0eb19fed
- SHA1
  
  24b31b8e25757f0b3c94c143435fcbd084eb3c52
- SHA256
  
  eabc284aad668b0911ea92fea5b0fcd2803fbfdf651b5fa0b4cf5e0b63544a12
- SHA512
  
  af379acccefb60b1ca465076469c57d09f846467b94f4ae500dcaf0c69e4418d2bf5cac3af89ad3e177291ce1d63d0649f34bc5ebeec714b66d98b365901360e
Score

3^/10
behavioral5
- Target
  
  Electron V3/workspace/IY_FE.iy
- Size
  
  539B
- MD5
  
  291d5636a434c4f1ceb0f3f776c2a51f
- SHA1
  
  ae287e08f71c522a72812f0dace94b8ffb569341
- SHA256
  
  73bb58ba5b81960caf5a8e66675cc89b5761b77db99c6ceb9435f7211d400452
- SHA512
  
  7dab8034f85aef1b2b7a86cc8220ebdbb95a3f083d1565e1cff38414367aa69fc597a11aaba11dbef411e13fbfb285855d9c46ae59738f6e88c22dd55c81a743
Score

3^/10
behavioral6