Extracted

• • Target
    20a65819fbaee5808403b46f61b3f52152169b36278e3575afc0821a67e4899b
  • Size 1.5MB
  • SHA256 20a65819fbaee5808403b46f61b3f52152169b36278e3575afc0821a67e4899b
  • MD5 3bc2006c3944dc4db8b71d338276953a
  • SHA1 c0802a048a847f485c54304ff40de14766916855
  • SHA512 a68a26ff6d80303b22905621c08bf937f39fed897aee9e1128978d1481301d106b0ebdc71165b76dab57668d40e16254548b55524503098324112404564ba09b
  • SSDEEP 24576:zcWX9sAMpwPrBfvxDCAL1rtbccHb67zlgIsySDym/dRmcd2UvXfGVPp/1Rhv94eu:ZX9dMp6p2KFNHb6vlgIsySDpRzd2UvXb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  adwaredelimdiscoverystealcpersistencespywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1