Extracted

• • Target

    27267ef964c6a63e33899a21fd121e78.exe

  • Size

    3.7MB

  • MD5

    27267ef964c6a63e33899a21fd121e78

  • SHA1

    d08d9ed964bec7ce311ab9397b183ff92434b014

  • SHA256

    c0a8b772975259c3689d7fb83369fd211666217b7fb79192551851e8a6390b26

  • SHA512

    0956e365f70411a78b81b91f88ae4eec64b1704d05d1de4120edf97b79c4bc1206f93bb35eceffbaef5479cd491a818a896926cfb4f68897129f9c4accec92db

  • SSDEEP

    49152:4vKWgICXIs3zby2amZ+Vc/9HKGuMLDgtwe5EnvNtorahDx6+ZT41g85eOU8BPRV3:4Cz1RaUBKxtpivLf5Z41CqRVMU/

  Score

  10^/10

  stealcdefaultcredential_accessdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2