Extracted

• • Target

    5f0a8053622571e3d759ce364218740615eef3be5a23a338d1bce8f1d0f42d84

  • Size

    257KB

  • MD5

    5938a10bac157a2b7cae4c5413c6bf40

  • SHA1

    b9a3cd369cd5877d4593249bef149d2f4afe92f9

  • SHA256

    5f0a8053622571e3d759ce364218740615eef3be5a23a338d1bce8f1d0f42d84

  • SHA512

    1f0b310b34dd572def966d2334389c6f80e9b599497383e32980bb425b7c51420907874e2914c88c5517cc216f959dfa21a4118c4377c15386a867680c0621fe

  • SSDEEP

    6144:aHHG6eOxvvPgDszPmPQMHe50C0Zan20F0mmRCEO:gVg8uP/FW/lEO

  Score

  10^/10

  stealcnordcredential_accessdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2