exelastealer | 8a7e99e5de95407e2a7c2a373772882191804e335bf10997c9a7b59155efc5f2

General

Target

bootstrapper.zip
Size

11.7MB
Sample

240829-ngqgqs1amm
MD5

a4f30e65c44b96499d7dc842547c1a67
SHA1

045f7a00c8d4b75e8fe0c9fcb861ab9761e6c4dc
SHA256

8a7e99e5de95407e2a7c2a373772882191804e335bf10997c9a7b59155efc5f2
SHA512

30799426fff6ccef19589fe93c87b04131ba620a39b556f6a6fd88754aa47f8f5cb8471d10839ffe84f0158d6ba838a6798cc32d40223e03dbd9cc11e2d2e0cf
SSDEEP

196608:OnaMj974J5vQOjOnNCQc/71U2tMzQMamlN0dBMhQyZGe6twCLXc72/84feFhebh:qj14vQJlcJU2OzZamlNMehQyAZXcq/8Y

Score

10^/10

Malware Config

Targets

- Target
  
  bootstrapper.exe
- Size
  
  11.7MB
- MD5
  
  482834c632c49ca2c7168e0d087ca565
- SHA1
  
  c31a1ddf1912e563129e9d2ad4f31757cbcd8c27
- SHA256
  
  d2e51f367d34d1eb27a140f3cba9c6744004348434292d7fbcda2aaa954aafb7
- SHA512
  
  26f92521ec240a42ac7e2ad04f0a8698d2ba173b265f62310be8fd50c85a9c84a419b14797f8b896b84ccfd730814d82165b10871bf9efc0fad9a905f8cbc1ae
- SSDEEP
  
  196608:CnaMj974J5vQOjOnNCQc/71U2tMzQMamlN0dBMhQyZGe6twCLXc72/84feFheb:Oj14vQJlcJU2OzZamlNMehQyAZXcq/8m
Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1