Extracted

• • Target
    file.exe
  • Size 268KB
  • SHA256 9c4dca830487bda060624059ffc910041ce76975a00750092fcfbb0ba99512ce
  • MD5 a2d6bc4c76921e184d0a81e79c40ede1
  • SHA1 befa619180442f1a3b968f232d68a18d6ad58251
  • SHA512 398cb34178d5f9b31e3cbddf9ec6946a923f326b86afb7d177eb6c223507d77501a73e12532afe30abb63227ea76a08a821e4362b98451bcb7c7066894e66e30
  • SSDEEP 6144:Nm9eZof7jnUYN9mzfYJxM03MKJmuK9zrSaANpJe+PCnEO:Nm9IK77B9mz7KJhK9fSjJdPYEO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealccrydiscoverystealercredential_accessspyware

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2