Extracted

• • Target
    file.exe
  • Size 206KB
  • SHA256 15fe853ed8e30dbf3b1d876e04dc498a2da5d1526644d08321e1ebfdf4ad3229
  • MD5 031c64767f107ce5181e949985afd3c5
  • SHA1 7fbeebe8292a650100426433f6602f053d16bda7
  • SHA512 c586742f344e326eb41658c82b2a8a90d97b701e6b1d4a1a09c169000887da81bd940b53cc36dd6be34c48b9b212b79f240cdc0399830fe02d87314ab2269d37
  • SSDEEP 6144:JIeRy8saXtcJ60Z1O6ax2ux3wEEN9FwDPU0EO:JIeRaaa/G2AiN9FMPU0EO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcnorddiscoverystealercredential_accessspyware

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2