Extracted

• • Target

    External.exe

  • Size

    4.1MB

  • MD5

    7b9641ed9ec61b9373a59bf5a2f03d72

  • SHA1

    68b9c7560f8c2a907fb7b917fce027a206084550

  • SHA256

    a67d7bad3484883985727a2dcb0d586104ba10c3eed594a878c2fb1f8db92536

  • SHA512

    74cbae4d841f5749013b01324e3ccc2920686de5da3107e2c42604afafcd038acfb53837b0433d2f160201d68910a103f6abe6dfe5d21becf3fcd594734dc59e

  • SSDEEP

    98304:DjQw068KkM3pcPuOI66CF+EVeeVlRi0Du4Cs:1kY6Pbpt+ETlRDu4Cs

  Score

  10^/10

  sharpstealercredential_accessdiscoveryspywarestealer

  • Sharp Stealer

    Sharp Stealer is an infostealer first observed in 2024, based on Echelon and Umbral stealers.

    stealersharpstealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4