exelastealer | 597df827f3bc0585d798235d406cba636f7b9227c15a35decc79b6a3bb5c2ec2

General

Target

240907-j6hqzatfnj_pw_infected.zip
Size

12.1MB
Sample

240907-ka7wnavbqf
MD5

10e8bbb7591555f8305f12fbc5a7296d
SHA1

7df3090e2ead3b4eae44986af57ef3e5f6614278
SHA256

597df827f3bc0585d798235d406cba636f7b9227c15a35decc79b6a3bb5c2ec2
SHA512

28e3abc3616124ea3b0d8c2e87e4fc32037999ed15475b2b760ccc69f1142e9205f74f829a37439683e1054edc42bf54cfc12c25a2d314d170b2d40597474bd1
SSDEEP

196608:JIcMEhZoXRIFYHk0XNIFygvQtrXz6nRyFv5tAgUAtf6jGoChRsRKIn37f3NbsOa+:J1MtG6XNYFquRyFhkjGokRsj71s2qQ

Score

10^/10

Malware Config

Targets

- Target
  
  hider.exe
- Size
  
  12.3MB
- MD5
  
  1ed470024ef6d1da212a8ab65f235251
- SHA1
  
  77602fb050caca16f77f15bb106445589c129da5
- SHA256
  
  c5ebe9760eb50e90a285ce5c21ea807567a35b02fd70c3ee16d707f7fc20e6ea
- SHA512
  
  d5ab76fdfa2c19f6a62f1892f61bd643b276e8fc4371769010cfda3bce6a61ba263bc5778a23f980a5bce9705e38a0fe51bf6668da9f95027f7fb3370aa01f17
- SSDEEP
  
  393216:WeC4dL01+l+uq+Vvz1+TtIiLPY9Z8D8CclsZOVX:WN4R01+l+uqgvz1QtIua8DZcSK
Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2