Extracted

• • Target
    Launcher.exe
  • Size 1.5MB
  • SHA256 e2a22e0603f05d3e7e7890788fa9ba830f8ccc15e877a5be25d8922114c1e691
  • MD5 6ab8896db54c7e60cb497adfcdfd34b9
  • SHA1 1cfcd049d0934cd70c6215c9d509173818d8cb22
  • SHA512 6852cbdef0e938e56fa52290012d33a00d5540ce65f647448cec46581ad22bf8f3735bf4a61d6e6c2ae137641745d9a4b769bef3ee0eefbb5507d8d7251ecc74
  • SSDEEP 49152:jXSVJLoVF1VXjUf2W6KleUDqBzhSmKIYDzngBMXLzYb:jXoF2xz42NKleUDS1zK1gBMXLzq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcbibadiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
  • MD5 08e9796ca20c5fc5076e3ac05fb5709a
  • SHA1 07971d52dcbaa1054060073571ced046347177f7
  • SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
  • SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral2
• • Target
    $TEMP/Experiencing.pot
  • Size 160KB
  • SHA256 a359d5a9860f6727f10ddb434e8e15e9d5b04114f5545f313715c295ff74aa92
  • MD5 07d70318b5d1a94df8e4739f897905c7
  • SHA1 110c29ad65b5ac45aeebc6a20bb52720b734299e
  • SHA512 0590d8160527219a1fdac38ea19a211c14f98ee316370b16b4b92585642a365337d2d5c7a04995feaa77b604cff16f5d392d6ca428db58207a9f87fecf8cab9c
  • SSDEEP 3072:WpUoJrDziB5zRfM1UWSpXjL/RpSbklfpXVtcs2DgANqMILhm:WDnziBRREUWgppSNJ+hm
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3
• • Target
    $TEMP/Fisher.pot
  • Size 273KB
  • SHA256 c94cfb9e20e86b1fc85e8f0d1c0a7c919d8d4bfb0160df5397dda5e7da8d796b
  • MD5 5405e4d70aac33cece9b7d0ff21044d8
  • SHA1 b5f5746246d4450c75c77861ed4a5992b99ea569
  • SHA512 663b08a944e0a9fc7f50565da44c4c9305215db286f435806c86af4df8f581948f7d2e8a0f57c3b6593a9bdec2cf4a4dd2faf792b8f9b8324bb93d4c10e93f23
  • SSDEEP 6144:WpR7tuAu8hSLc7xWeemw8+lJNV1WGqU2PvmpP0znPYl1SAILX:euAu8ek8UwxNV1eU+Ox0znQl1S/X
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral4
• • Target
    $TEMP/Geometry.pot
  • Size 10KB
  • SHA256 095206716f0747e70fa7655a088f32276a8b3d3d1a99b06d69dc5b33c325e20c
  • MD5 bedf2d53bd88aa62fd782280835f0692
  • SHA1 220ed5613651114ee629796449da6a1387e1b3f0
  • SHA512 8aaa28a42c6f485d52f6f270672dec4d540f7cb3b498abc3716542d34fdc2f2fada18c8e0da0b21806c5d55660eba6f16eaac597f48d28ff3e4e23ee7df472ab
  • SSDEEP 192:uayoDauhCHs6o1nZ/2AdhlvPlTIjdEAbWG0/mma2zLGWBCtGXsb7cTXrxfRT8:uPoDauQHKNZ/2Ad3+4G0+szLG8GGXsbr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5
• • Target
    $TEMP/Indonesian.pot
  • Size 180KB
  • SHA256 470de4dc6b92753992e12d0d2363d52cbdd08b0da57eddebd8b19b8874798732
  • MD5 1428d5eac8a6176088f1ee702f1631e0
  • SHA1 070ccf9582bea0cc6f184b43d4e82f949af96c42
  • SHA512 65d030de69b4fb754a258a30fab8e4acfab847259f40c688efb965b94cac564d006ef2f59fb9ff37adca805c6d7a3604fd20a2729e58d53e155a4af2c617d3ef
  • SSDEEP 3072:gWma/Sa8OyUMrMGkV/RgS2eg+S0rVbP60MiVBsYIvUoYCdY3RJED4zf8:gWH/6OrGkV/2VeV7rVbP60DpIM13RLQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral6
• • Target
    $TEMP/Promises.pot
  • Size 115KB
  • SHA256 4d7e2369638af147056ec61eaf85fcfa726b467619c8b5d8bec88d83643f0bfa
  • MD5 0f53aaa058ad5ed22f6ea68156b368f7
  • SHA1 3b2a93b3e5cedd0363b3aceaaca6ae3149d9d7d6
  • SHA512 30dff3e3d0b8521da66af97408dc826a2a2e8210638c1d15a3b6783e07ec3b5f0d5a56000d402749193ed870b12602dab4200668006d445bf3bb2ec8d57bcbdd
  • SSDEEP 3072:lQKi5Q17tOS6vczUGXf0IiYre7ISFZ77odKN+ie:6Ki5QXOSTzXfXDKUSFZ77odL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7
• • Target
    $TEMP/Space.pot
  • Size 189KB
  • SHA256 5a93092e34a88d010325f6d3c7627e2ed949421f67a4ef79de3f8ff785f14355
  • MD5 91a90938955c8998283b6173f92e40fa
  • SHA1 c3ee5746736ac644bd7ff2506568fd5db07aa18b
  • SHA512 a28d880c646b179691c242aeafa931b3ed929ad62fa07388189052ef59d8190661370937097e903ac836a3d0daaca81d3a4ee7feacdacef0b14e3d370969c6f4
  • SSDEEP 3072:n+lCLSFfEFlJMvp4ihfWXlF4lLuTHVzKrugHaJndczdNs53j8UOm60:nolfyzU4kfXlLuTHVzKruOarcJNsNjO0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral8
• • Target
    Stellaris.dll
  • Size 88.0MB
  • SHA256 a39ac4ddf69367b791b0a57d8e8b0637e6fb2374fc5624282f535bf90d411f45
  • MD5 9f6ab13398095ff653837d6a7ab848f7
  • SHA1 2ab083aabc03a2ec20c5757d3467524eb589fa66
  • SHA512 44bde7829f89d186eeef83a4a5cf7d25680c09b81d767095faa53f7118eb3320a6831af4eaf2526be1529076d6360be7535321856b58c0c99fe0805994cb4421
  • SSDEEP 1572864:ox+Tb4q3tR2jtxFrs8XuYSKB5ZM9BljCqZ0iAGmJlC+ISf8ajvE:ox244tojpPSyzkqqZ0iH7QE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral9
• • Target
    adobe_caps.dll
  • Size 1.0MB
  • SHA256 502afd64541dbd1a10088f3bacf6047d08b06c9bb82191714c2cf49f89a8547f
  • MD5 6028b7ce65512ca328710e163bafe292
  • SHA1 061df5500d4802e0d5b900cfe72724f8c2f01f5d
  • SHA512 4752190e974d91a722e0d42db23ce881eecce7f6304a94e516e3f43937b423ef0871563729104346a01400f5febbba5d85dbd354280c6bd18862b18a5cad21da
  • SSDEEP 24576:jesi4PPQ7BG8Xtkf2VeGB9HCb5ajdWkyRTn41y:hiAP5Ytkf2kGB9HljdVYTnd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral10
• • Target
    dvaaudiodevice.dll
  • Size 1.8MB
  • SHA256 042930fb5eb3d773d138f85da8ccd695a03a9a687f369ba417713c780ac480fe
  • MD5 87c946235cb30119892da78ee8d4bd65
  • SHA1 d31e2c1a4767acb8bd44cd9374b0bd3f48691953
  • SHA512 afc44fc4435df0b56edd7efefbbf8789945e663aa2c204cc68392563f6ab6a354a7ad4a5ffdc6d8a6bfb5f381f077d606e01b196cfb67465e277c8f840139ad2
  • SSDEEP 24576:FTliR1pdmiHM7HbEanrkkezg5SlqXz+bXmPuPQEqcS1Qk9Qxv+9zxfi:FTlifp8DbhrkXmsqXOXmPZQLvca
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11
• • Target
    libfilezilla-6.dll
  • Size 421KB
  • SHA256 f4180a1d20fa429654c970f301d41b97644824105b574fab28e4986121a0b5da
  • MD5 e0ba00bf401a87adbc2a8f56e8d4ea93
  • SHA1 f0d7a3e566c66c544cc53a61f849f98dea916865
  • SHA512 2246f8f77abcfb445b3a281b28c41859c0ef1caa290c5960688101cc7fc3de7f55498b2adce29ac32c67cf6769d5ce8126b3ad1b9116eb025b59a6f72f74a62a
  • SSDEEP 6144:0b3YdeQjdgdPt7uhsmt2CF2RXkusUf4hgReyCYxPDtQ0CKq2sod:0zYIQjdgddmt1/uc+ReSPDtQGd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral12
• • Target
    logs/PSCloud.dll
  • Size 2.0MB
  • SHA256 e4be076c9411cb0bdf530f50b84b19ce958acabd8edb40b3edfb9d8cdda6ce6c
  • MD5 9a345b2c3b6f6e81ae4056036f5f5a63
  • SHA1 b1b0b2fc956cf3a899320199eb0301fe5401c699
  • SHA512 05c6581f830e6a7636f2e4ffff5f701d9d8f8b7a8a280db9db8ede89a29b49a52ba9502fb76f177854ca02668cd4bc1ddd0459f087afc77c4e34cbdfdfafeebc
  • SSDEEP 24576:s5YID88h/L78oK1/aMIPY91xYxQjAQc07PAR:s5YI88FIoK1/aMIPYOxQcQDk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral13
• • Target
    logs/dvascripting.dll
  • Size 1.4MB
  • SHA256 e960e8a546405fa395c5e6ec9d429b50a04067206af91198a6ae7c3d4bea107d
  • MD5 2d2c1c83f88047be558d171f3fcdcf4a
  • SHA1 d46a349a9417c49380c2937d471a116e8dd40bf9
  • SHA512 1bb73696d913f1906331258c2847c18c83ff4ab7c1d1a59bcb399264a4a1188ad274ef450af9d9b17c58633e159a87c8dd742430f652af7266db4c989a729cdd
  • SSDEEP 12288:PHEDy8Ze1cD8EC0WvTT3mag1SrJXoHI3R74XxIOjDyv:PHEDbpY3g1Sloo3K3uv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral14
• • Target
    logs/libiomp5md.dll
  • Size 1.6MB
  • SHA256 723d03a29d1e0ad629a5e6e3bcee49ddb455434778cd5799aab6d727cbd98275
  • MD5 3c4275518d10638fcd05e4b128bd0aa1
  • SHA1 c8d486300bb3a839db04e1083abb2dd5cd8bbed8
  • SHA512 f355a72c0499b92eeccc953abf7bb3afe03345dfe070760402920c0a4bae05fb254e698e5aca30328b11663880bf57b9e97ce7bccb7e526aa1bfd1f10de5f6f1
  • SSDEEP 49152:jeM4x2BYQKNaoWcGwR2j7ekkB0Do0MG89CPl7G2a:aGCWcGwOEq7G5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15
• • Target
    logs/mozglue.dll
  • Size 1001KB
  • SHA256 30a42964ffc0ef3d86b96231ee59b1d0b706e0e72449aaa62a4ace21ae93cc4b
  • MD5 1585506187ade02bddf457732ec2d333
  • SHA1 00da4ef4ad23fd4dbd62d608a1518d24707a5aaf
  • SHA512 68a8295f57b9b75458de3814e151d6a998a621b21531f72696682f43684b944f2f73013ba4399d9128c4f6511726788a83e6acacfc5f2fb16632d9f4cb7e9b20
  • SSDEEP 24576:BzI8J6ANHNMQ8rI9EkTRWw9UIc5qemJSrL1R5372C:B9NHL9EkTRWbIc5LmJSrL1R537p
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral16
• • Target
    ucrtbase.dll
  • Size 1011KB
  • SHA256 6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
  • MD5 849959a003fa63c5a42ae87929fcd18b
  • SHA1 d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
  • SHA512 64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
  • SSDEEP 24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral17
• • Target
    wxmsw313u_core_vc_x64_custom.dll
  • Size 10.9MB
  • SHA256 306478761b59d4aba7e634f8e8bf0f5d8820a2036848f29e0e8949d77f46b990
  • MD5 3b0be860850a6bc324306f0329980e31
  • SHA1 1e42ae07e62adc5b28cff19a3a4d3ac34c96fa69
  • SHA512 803e4cdd26737c6df6e4a6322d1a87f6feb6719b3d9221da61b8f1f9fec97e96241820a2c2bfd9ecd0eeac72d7197d8054171b60efd9d3e169b16b37fbaed574
  • SSDEEP 49152:UATp6o87WVzL5SIcgSyYEAz323js5FbhpA2aJ6kH7ZMgOH2bS2ZFxMc9WHVOeTHP:9TYOiHfZXFbhp5YrDB/jycVq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral18