Extracted

Extracted

• • Target
    zalupa.ps1
  • Size 3KB
  • SHA256 fd4498a7f9bc714466a86f59aa4565a2b5f4c4eee7c1a36e71fac43d7c876abd
  • MD5 5d2f32cdb2b2e2130af09ff13d315f92
  • SHA1 6e00efa566cdbcaacbab9d80779e3090f911b739
  • SHA512 8e74e6fc3ed324e53e4744de055de4b62dfb6c54990cdb0af71618cac86a9352eebd2b2c266240629fe320a171290bf44965fffaa5a9d6f81aff9b9229267752
  • MD5 SHA1 SHA512

  Score

  10^/10

  ripnewdefense_evasiondiscoveryexecutionstealcspywarestealertrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2