Extracted

• • Target
    file.exe
  • Size 197KB
  • SHA256 e70366376945fbf83f23f1631eae3baa6c7b43a2c76390c2478c7bbbb52ee0e1
  • MD5 8d2cd115a389abf08f6b7888d0617b3d
  • SHA1 d662d702e6b4845fc20bcf0a47967c15d5a96372
  • SHA512 7c81549a36f6726f8b299bb67ef47ec9b9be7649468177e58feff36762e2c9f35d90a0c8a1ee4d089d76564cadeadcbdd83d705293554b0c7b5a34a5fa9ba691
  • SSDEEP 6144:rJpj2x2P/zmi986GTY5P1AvNN2+w+mO5CeU:rJpjo2LmSGa1WN2+wdO0J
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcnorddiscoverystealercredential_accessspyware

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2