exelastealer | 250304c096d7c45d47d76d689d3bb221ac8dd5676b55dff5241624f3c1f37304

General

Target

V1.7.1-Fixed.rar
Size

385.2MB
Sample

240921-n7rgqa1frm
MD5

a48f94c94a8fb01f8672db47fc773a1f
SHA1

90c21b0cee09cd5e90d0e12cd822ae30e1cadf69
SHA256

250304c096d7c45d47d76d689d3bb221ac8dd5676b55dff5241624f3c1f37304
SHA512

a875f8d40024acc25aa1012f48644eeb1ac2e1007b2bfd89c097d9651255e94855a4166ef82e9acd3925bd15e7b7159290d387b346c09ecc565dd76c756cb940
SSDEEP

6291456:kno2gaRjLguo/vfPdRhhF58ygfWLP7mnPAkUn/VlGbo0kzPtCWy:h2gAwPJR8nf8PsIkIQoJMWy

Score

10^/10

Malware Config

Targets

- Target
  
  V1.7.1-Fixed/V1.7.1-Fixed.exe
- Size
  
  385.3MB
- MD5
  
  2a8232328ce1284a136daed4eef7aa9f
- SHA1
  
  7fff50776487cc4b04a56d229f00cdf9dd81c32a
- SHA256
  
  1d0c2aa2a51d30c38f461d7af3709c14ff9c5e009509733c453233b5d243eb8e
- SHA512
  
  651d80097d01074875c69dddd396108348306799cdae4ce63a15c985cad051a617ea102fca07c25cff71feaf13deebfe62d6dfc89666c574df6746bff89e2614
- SSDEEP
  
  12582912:XZy50LHPZAtgAzt//N0vsqNbCFxocf5HIdE:XZdLvZAzlAxmD1Iu
Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1