Extracted

• • Target

    80b5db038716d49c30a2258b44e05090bb63e470c6bd5bc067958c0d3b3b73c2N

  • Size

    502KB

  • MD5

    255aa859c24575b55d2476fc42ebfcf0

  • SHA1

    d0b9d931ba49b12edf649179c3fee9db5d0e13b5

  • SHA256

    80b5db038716d49c30a2258b44e05090bb63e470c6bd5bc067958c0d3b3b73c2

  • SHA512

    5e2d5aa2a85456b849bb8788de6f539d0bfceb34404ba4eb33968351d3b082cbda3d131e06e19412ecf03c29dcc9dcb28befb4f5801a6f660624e34158b7f3ca

  • SSDEEP

    12288:HKKbpydeHVh1nDVrJQ53MCcstcVjgUh4oan7rKo:HKMydipnpVQSstcrpC/x

  Score

  10^/10

  stealcdefaultcredential_accessdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2