Overview

overview

10

Static

static

3

setup (3).exe

windows7-x64

7

setup (3).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup (3).exe

  • Size

    12.0MB

  • Sample

    240812-cfzs8szflm

  • MD5

    2474594d95dc14b90454aee6887e640c

  • SHA1

    8e9fb42305ef1374b3e8ccc70ae4124d8518a138

  • SHA256

    5991cbdd01e767ffa7bc10b873b55ebc15baa94f1756e07eddcee878f8dede86

  • SHA512

    9722cf373ecda8dca33ca790455d7aab60925b22b8e4e65193e8045a70090ddc2b75e9bd9465fa2a2525272bbe5d6aa40351d7773db0f72a999f466626cdbd5f

  • SSDEEP

    196608:/Vw6eCdqyU3b01Kpn3V+uq+VvpoA1HeT39IigQCeE9TFa0Z8DOjCdylVSE06Qf/v:9eC4dL01+l+uq+Vvz1+TtIiLPY9Z8D82

Score
10/10
exelastealercollectiondefense_evasiondiscoverypyinstallerstealerupx

Malware Config

Targets

    • Target

      setup (3).exe

    • Size

      12.0MB

    • MD5

      2474594d95dc14b90454aee6887e640c

    • SHA1

      8e9fb42305ef1374b3e8ccc70ae4124d8518a138

    • SHA256

      5991cbdd01e767ffa7bc10b873b55ebc15baa94f1756e07eddcee878f8dede86

    • SHA512

      9722cf373ecda8dca33ca790455d7aab60925b22b8e4e65193e8045a70090ddc2b75e9bd9465fa2a2525272bbe5d6aa40351d7773db0f72a999f466626cdbd5f

    • SSDEEP

      196608:/Vw6eCdqyU3b01Kpn3V+uq+VvpoA1HeT39IigQCeE9TFa0Z8DOjCdylVSE06Qf/v:9eC4dL01+l+uq+Vvz1+TtIiLPY9Z8D82

    Score
    10/10
    exelastealercollectiondefense_evasiondiscoverypyinstallerstealerupx

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

      stealerexelastealer

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks