Extracted

• • Target
    External.exe
  • Size 4.1MB
  • SHA256 a67d7bad3484883985727a2dcb0d586104ba10c3eed594a878c2fb1f8db92536
  • MD5 7b9641ed9ec61b9373a59bf5a2f03d72
  • SHA1 68b9c7560f8c2a907fb7b917fce027a206084550
  • SHA512 74cbae4d841f5749013b01324e3ccc2920686de5da3107e2c42604afafcd038acfb53837b0433d2f160201d68910a103f6abe6dfe5d21becf3fcd594734dc59e
  • SSDEEP 98304:DjQw068KkM3pcPuOI66CF+EVeeVlRi0Du4Cs:1kY6Pbpt+ETlRDu4Cs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sharpstealercredential_accessdiscoveryspywarestealer

  • Sharp Stealer

    Sharp Stealer is an infostealer first observed in 2024, based on Echelon and Umbral stealers.

    stealersharpstealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2