Extracted

• • Target

    ZoomInstallerFull.exe

  • Size

    85.3MB

  • MD5

    0ad91ce888ace42b95ca1c9bb5b47a75

  • SHA1

    1c3b3205f99cd54640a0eedee9e689bb8acb6ca9

  • SHA256

    4c582dd6e6b21ff8f9bbd470876ebe06f008505ed498abb38c34038cd5c1c3d7

  • SHA512

    58ae442e2224e07824d4443cbb0c3c43f555b3f84c59f49e85eecdff7f11204729165ad678c433d9102ef73d28aaf70157dbec7a031d589eb028cca4704d8945

  • SSDEEP

    1572864:KaDXhgywVFx7XC9US6K8Xotmi4PEC+KuzGQ+CHM2+A2e2cAaXs9:KMXNqz7XCCVi4PEC+KO55s2f2cF0

  Score

  10^/10

  credential_accessdiscoveryexecutionspywarestealerstealcdoralands23

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral1behavioral2