exelastealer | f0e3a7604967b28a7902c8a5db1a9e60453a65048359f97d41e2e374de6bbaab

General

Target

xkowhook v2.exe
Size

10.8MB
Sample

240826-p8e1ravdkf
MD5

fad1255f32bd8e586b502d6834f1965a
SHA1

459862ff8a65e2c4846a9ff4c3fff90d3b16fec2
SHA256

f0e3a7604967b28a7902c8a5db1a9e60453a65048359f97d41e2e374de6bbaab
SHA512

334ea48c00484849f86f061e954cb2af65eaea5bc65ca1bdf6ef16d86e88a9021f76cadd4993826e04b327c4d63a2e28e77e8c4fac0b68bcaf45ff1b2dc3de99
SSDEEP

196608:F5t3cANrPA4mtSHeNvX+wfm/pf+xfdkR0ZWKsnarIWOzW0DaqkH:zavvtSUvX+9/pWFGRiBsnarIWeRaDH

Score

10^/10

Malware Config

Targets

- Target
  
  xkowhook v2.exe
- Size
  
  10.8MB
- MD5
  
  fad1255f32bd8e586b502d6834f1965a
- SHA1
  
  459862ff8a65e2c4846a9ff4c3fff90d3b16fec2
- SHA256
  
  f0e3a7604967b28a7902c8a5db1a9e60453a65048359f97d41e2e374de6bbaab
- SHA512
  
  334ea48c00484849f86f061e954cb2af65eaea5bc65ca1bdf6ef16d86e88a9021f76cadd4993826e04b327c4d63a2e28e77e8c4fac0b68bcaf45ff1b2dc3de99
- SSDEEP
  
  196608:F5t3cANrPA4mtSHeNvX+wfm/pf+xfdkR0ZWKsnarIWOzW0DaqkH:zavvtSUvX+9/pWFGRiBsnarIWeRaDH
Score

10^/10

upx exelastealer collection credential_access defense_evasion discovery persistence privilege_escalation pyinstaller spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2
- Target
  
  Stub.pyc
- Size
  
  875KB
- MD5
  
  9dbf6a4b30e6043bf50b3aab03003a00
- SHA1
  
  4bf06145318775f2d3d179dd5355c38616462d78
- SHA256
  
  9d9477ce7b8c679ecca55add74d4d0e397ab09ba73fa9d52dbdee9f7ad585614
- SHA512
  
  f553227ffc7b56d9f96d2cec0dc2de60d2a405ae482d6aa405e3c6121e50b6f1d7317450f1ee497379d65178107c10862f4d086e1461f47dfb956b1228adc385
- SSDEEP
  
  24576:mASWpGCsTo1NLroilJoNIaEGcMb5E9IgbFReYjCntcOos:mGTkzRcqeFFO7
Score

3^/10

discovery
behavioral3 behavioral4