exelastealer | f96348bfffc7623d80de75b78930f8c16056ca45443bb9267e524ec928ce251e

General

Target

ElectronV3.rar
Size

10.7MB
Sample

240805-atbmfsvfng
MD5

f57bb89880b1dd2a614cc559468e08c1
SHA1

e99d4aeee114bf361b12908dc5ffd8a47caead05
SHA256

f96348bfffc7623d80de75b78930f8c16056ca45443bb9267e524ec928ce251e
SHA512

57eab63c1c629c5add7f9d636a146f41d26afb3bfdca02a0091b088ff7e190b3f3cb9e8983518d958e96e0e4da1082f204a585e128898737bee3e665c03afd87
SSDEEP

196608:fRMiMBBi6n9IVXKwGZtjQKjhkattGuEmGGkjVfIlIV9/6S1ex8J4/cJXwpNoDRre:pMiAiiSAtjLHJEmGG81iMES1eH/cJXqN

Score

10^/10

Malware Config

Targets

- Target
  
  ElectronV3/ElectronV3.exe
- Size
  
  10.8MB
- MD5
  
  0339a0384386f21d256f465724f04598
- SHA1
  
  939b4f540e6e81609c0313e4138c66c354ee1c7e
- SHA256
  
  29e2e23ee36ff8e55e51a6ddaf82beaeee793e352193f80ce8748753d2b09059
- SHA512
  
  b03537f21de20b9cb9923c6b9db3f97aeabe6ef0ba02a58e92eda79919cd1780a6ede4508c4891c3fbf1fad7ec4c5220886d8386dcfee139bbdd6ddedf0e05f3
- SSDEEP
  
  196608:wSLRPANmJb3tQk5tOeNvX+wfm/pf+xfdkRBzLWK5rIWOzW0DaqkH:xLmNm7v5tRvX+9/pWFGRhLB5rIWeRaDH
Score

10^/10

upx exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2