exelastealer | a157d6ce2c84c4d18e57ba2cd8e10de53729762944c29b087d3ece428bcc36fd

General

Target
ElectronV3.exe
Size 37.8MB
Sample241027-ce98kszpex
SHA256 a157d6ce2c84c4d18e57ba2cd8e10de53729762944c29b087d3ece428bcc36fd
MD5 9cc8a568e798cbe6662932da7233dcb3
SHA1 537c3aa9fd7730c39407f5df2dd1c1b6d9052f57
SHA512 47a5598d45a55fad62be7a6f61d86d41d6431af7721d30fd2778f9ea46f0d52d2c67f21607defaf3fa5fcd258b1ff8ac25eb2a068fb57be2a2768163ef5416d2
SSDEEP 786432:S1mR73onp2D/L4Ex4uPvOkxSBG4kcxDD74R/7K4rv3FqbR:S16gu/EEC227ABch8R/GUqbR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  ElectronV3.exe
- Size 37.8MB
- SHA256 a157d6ce2c84c4d18e57ba2cd8e10de53729762944c29b087d3ece428bcc36fd
- MD5 9cc8a568e798cbe6662932da7233dcb3
- SHA1 537c3aa9fd7730c39407f5df2dd1c1b6d9052f57
- SHA512 47a5598d45a55fad62be7a6f61d86d41d6431af7721d30fd2778f9ea46f0d52d2c67f21607defaf3fa5fcd258b1ff8ac25eb2a068fb57be2a2768163ef5416d2
- SSDEEP 786432:S1mR73onp2D/L4Ex4uPvOkxSBG4kcxDD74R/7K4rv3FqbR:S16gu/EEC227ABch8R/GUqbR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

upx exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Exelastealer family
  exelastealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  Stub.pyc
- Size 37.6MB
- SHA256 e06de4b266151cc7d17fd412723e80178b41cbb3f13f931bc118070e023a7b6f
- MD5 c1f5a25bda699900d56f32f969352b6a
- SHA1 8f52d813b1b4a7a5664680f31b5a4aeb1d90ad3d
- SHA512 4e1ade10a2b52b7c1893f24f92134f97dd8fba755620eb7d035f229797c69f806049fc989cd724c8656cbe6cc7f14669851261b23534af6a37ec7000a48b8b4d
- SSDEEP 49152:GX/NmNeavdb73ciXUSjXAPpfNSBBVnifV+w6WePfVylrys73r9bEHGUKy0MN80V9:X
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4