exelastealer | a8a33f6ec9f119dce68b9764baca7eac229be08bc888b661f26f2d2e31e9f2ba

General

Target

ElectronV3.rar
Size

11.0MB
Sample

240831-vp1e8svhqm
MD5

8af03091e9f91f37561e20d7447e024e
SHA1

23a63441238796a4927a85180f6d1bac048dbb5f
SHA256

a8a33f6ec9f119dce68b9764baca7eac229be08bc888b661f26f2d2e31e9f2ba
SHA512

b8e78ea6f1951272a10599010875869a1994099550ff4d202ca4ce51ea1340da97ca76412fdc01788d1035dfa21e3a44f41eb3cfb8fb635865d6f3d3005bfe1e
SSDEEP

196608:QRXuZC/qgGcwMMiICKxP7lwhNY2BjfwTgXe931UfyHBAv1IhP4rais7xs6nzpl4t:MXiC/JGFM3vMzlp2BjfsIyH2YPRise/t

Score

10^/10

Malware Config

Targets

- Target
  
  ElectronV3/ElectronV3.exe
- Size
  
  11.1MB
- MD5
  
  dd50ab40bc0ceeea383c132cc9ea965c
- SHA1
  
  c0ede9f69a2fcd7965e980654413854804e48ff9
- SHA256
  
  ebd33124981919a44841c9e215f91f622843ab2ea0c96cf1bcd44a82feb4dc1f
- SHA512
  
  fdec36007807500ae41b0afd400ef6727edb2ecd40646c41e76fbf4e6a86e49fab580fee57601972005adc0cbf7cda3be06d10e7da07deb7798dac8b887d098c
- SSDEEP
  
  196608:iW4JauwOFC/PAGJb3tQk5tieNvX+wfm/pf+xfdkRUyTlKArwWOtW0DaF1H:WIusAG7v5ttvX+9/pWFGRBAArwWIRajH
Score

10^/10

upx exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2