Extracted

• • Target

    dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d

  • Size

    493KB

  • MD5

    97bd4bc22561d694e20a92a863b98b9f

  • SHA1

    d75afdb66229cc85a8482777cefd4a9e62154be5

  • SHA256

    dbb939fb8b11e194fc8b03ca72644397e99ed91ecf03995eb7b9e0d6ac3c907d

  • SHA512

    3a4b96bb61f68a1481c59a831e76703297d9e461f9fcc8ebf0b0d341fc37b6e575ec38b7fdf23030bbcb469f5f55380aa688a1725a40f2315ca4d533e321571f

  • SSDEEP

    12288:z6l9sitPVqi7WPc/2HGMOj2K/byYGNihKmwgfUyzM4S:zlitrZRiK/baNiompfjF

  Score

  10^/10

  stealcdefaultcredential_accessdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2