exelastealer | 5839a68d266c598fb2d449bf4861e0ee40b1e9286de983e3060cb6bc0d7233fa

General

Target

5839a68d266c598fb2d449bf4861e0ee40b1e9286de983e3060cb6bc0d7233fa
Size

10.7MB
Sample

240909-tzkxvszgjh
MD5

8d6fb8576e447bec00445e50c93299f0
SHA1

322eddf9913caa1c3ad39d21bc00f34a073d1c57
SHA256

5839a68d266c598fb2d449bf4861e0ee40b1e9286de983e3060cb6bc0d7233fa
SHA512

e5aa68da965b6aa70fd954864fe774b230a254e8dd52fccd96d5f92261c0c840ad0522102adbab9259aad4ae9014157e3d8b3475ad4ee6befce795b605931f1c
SSDEEP

196608:k/2wPvWf0Pg7mDCfozNp/ki/mzf52rkX4PzZ+CwT2RSOHUwFKi1/:k/2wPrPg6DC8NpsLzf4oIPdpwT2RS2Lj

Score

10^/10

Malware Config

Targets

- Target
  
  ElectronV3/ElectronV3.exe
- Size
  
  25.9MB
- MD5
  
  915c2a21d534014de05f015d0cd24ffa
- SHA1
  
  206f5b6fc90a621b8f4a772a2aebaec27f3ab879
- SHA256
  
  658bb6dc4e254882f8eef5d9a58b9f61fcbf815b2f6a08b86bc36636bed9cfef
- SHA512
  
  8d2a89fa28f658c34539a828116c42a97e294e49ed8dddd69c2398147cf638e80e1caccdab10f85309d2a094b534e0f911c1e8b614071230602036f5314bb605
- SSDEEP
  
  196608:fp/Ew9t2PAymtSHeNvX+wfm/pf+xfdkRDjHKsn2ruOZW0D+qI:B/Ew9NVtSUvX+9/pWFGRnqsn2ruIR+t
Score

10^/10

upx exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2