Extracted

• • Target
    core-tool-galaxyswapperv3.com-7.45.9.zip
  • Size 149.8MB
  • SHA256 4f609dd3c1a45840903bae26082c3f566921ccdc6b8fdd2ecd307da66d92ffb4
  • MD5 bdca7690a0dc59afa1f0a82b84b9c5c8
  • SHA1 3eaaddd80cd1b4ba7c75b409e14a38eba0873b3b
  • SHA512 ce1e8a32658b6e03a0c017738e8e795207602d2df0410fd50e6e25955fdf1c0c09f728ffbd657faae308084c39684d7e585d5f51bf02a261a3382bcd2d132f9e
  • SSDEEP 3145728:lgTTRzMkXQCSr8Hcbgpa5g8Inu45LiuZXrIVDwAGiii8:lgBzM7r8HcbQJuQu7Giii8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Commons_License.txt
  • Size 18KB
  • SHA256 fa81f7d7a3d471c2edf40c69c63a2a5c9d3fdf83ea25afa1af997e329eaaa0fb
  • MD5 0ad6a564b00b7e947ffd4c146b2842e3
  • SHA1 f7a63437d53c9dad4470de5118a95d151ff8a561
  • SHA512 87be7c1c9fa59dccf2d585033943f521a5b25ba42c48e480f1ba8e0a065100df7a70646d906e677bcfb21adaa9967e275d2be990a52495c13680c3583f3ee9a6
  • SSDEEP 384:zkWo9bYpKszClYK2SeS6fOB40dCyxnXXwp+r+D3BlOBUUuhfQL9OipzrRgT0:zkh9bYRcZ2FKwjD3BlqifQL9HRt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  ransomware
  behavioral3behavioral4
• • Target
    FusionProcessor.dll
  • Size 95.8MB
  • SHA256 8f718aaf34ed3fdcb8bd8d7d538495d0a79c9985abf972953002a54398180f6b
  • MD5 79e75adc03134db1e3b94bcd2beaea9e
  • SHA1 e62112217f82d02a9139ae2a28f9d95f71d5d1d8
  • SHA512 4f9c947813f5637d9530ceb41476051c5c05cfa95a374415d487dbb3babe776f3fc1c6dfea336e64d399efb2d318b0eb99363ec1ec5d7af0eff114536a1b4314
  • SSDEEP 1572864:atkXzkCSrUtVBcbDMpiEeVrK7n9i3IPe+u/bbcNH59BiuZ2S71BKjVDBTs:ikXQCSr8Hcbgpa5g8Inu45LiuZXrIVDq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    TitanStorage.dll
  • Size 43.9MB
  • SHA256 ee6e36fc47be139989306fe9406a6d7d9f178c6019c5c98f325b91c0e8049a14
  • MD5 817686effe20ba4695e023fbb059e341
  • SHA1 0102d756fc97680c34f5d7fdb5576a9daee065af
  • SHA512 e5d21ca437500dd40432f19fe15788a875a795a3446e05c9651da73ba0ced733697589892951c645dca6d806662462feab009a8e335059d28801ae0626ad87c8
  • SSDEEP 196608:AtFlS+LEz0dIqhgRoKIWMAVeiFpTVUGiii5Yos4JwsOc2cbup9HMYQNAPdq4gMiQ:AUMdNhyIOklGiiinsncP29HMYQW5jR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8
• • Target
    config.txt
  • Size 24B
  • SHA256 2d9400233c8260727e86090034455a48649427c3085c8d7216e3196e48b442f8
  • MD5 5148e0039f816c8b620f360dfaa24d24
  • SHA1 d5bef07426ea18115f814bc8fe8c7e24bcfe1223
  • SHA512 d6f4bdce189fc666fd10bd4149c9c6d544f034828edcc649927c100d28b26bf8464bcc8ccfbb3bbde712a7b0cf13344a5a629e6ead6992604981e1daf0ddc519
  • MD5 SHA1 SHA512

  Score

  3^/10

  ransomware
  behavioral10behavioral9
• • Target
    core-tool-galaxyswapperv3.com-7.45.9.exe
  • Size 389KB
  • SHA256 7f2c5ae7c3fb101923ade86a2198a928bd3f198097bd657e9294b4dfcbaac138
  • MD5 cff16f1256b26442ba04a5d38ac60d9a
  • SHA1 2d81f1f60d74c97cefb7ffd88e89646be5cfe776
  • SHA512 0a9ac4c27fa1e4d27ed69fb1a480d4a50e29a8d07dc8b31f4fd5d63988196dae13a4c2c2e72ce12a5db872afcc21931e1758fe0688ef973f52d87901e00cd35a
  • SSDEEP 12288:bW5XWRC5FTYmYCQMZ6RkdLppyCA1+5F3fQwlvP7c/:a5XWwFTYxW6RkdLppyv1+5F3fQwlvP7c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sonicdiscoverystealcspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral11behavioral12
• • Target
    github-icon.png
  • Size 22KB
  • SHA256 17eba628a7dda862d236bca66899be4b80c02c57244f0fbaca573f31740ef730
  • MD5 f0fca642b1b10c65c5388d54264df46a
  • SHA1 2827ddafa45d9aad3c54f4ff581d046699e015fa
  • SHA512 48d09410cba82a923efc3974c98d77afea09a92bdeac603cb2439f8dcd033a863c59ffa3260abb4f9595d3fc2bff1718f627db96c695b6cf700dd910348795c2
  • SSDEEP 384:kagku6S2KQRNMvWsx5IK12VpYArX/JpZx3vag01/TqWrZy7sL4nGCOmWW6j0sBJ/:kagkur2KQRhYIZVbrj3ELfJL8GS6oGJ/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral13behavioral14
• • Target
    msys-2.0.dll
  • Size 18.7MB
  • SHA256 89eac35885ceee46374a54e9a8e8b9a3055d7e5c07e98a201001fff6414ec297
  • MD5 1bdf5787b62b6fbe0270fb7d25bb40b4
  • SHA1 54a5e38d7eb9cf98a698dc72b2a5b8122f4fd919
  • SHA512 90ceb29c8d1ef474333f290bb53083edf74cd1959e9aee50b425766bb25c0d77272f6333bb065df44c04e9e473b4aa6db944ee8c44ce506517eb4665a794c892
  • SSDEEP 196608:zkaLmQm/TxF6LY9NrFYpROMieYi5Huej5cMq1HZGZ:zkaRm/S09hQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15behavioral16
• • Target
    msys-crypto-3.dll
  • Size 4.4MB
  • SHA256 eb39f47db5cb8b0ecbd0825e03f009abc128669fa39ad4779e20c70bcf7ec2c2
  • MD5 bd6703723dfbfc6094fcf3b116ba28ac
  • SHA1 e40e119b567f482772c655fd74c0922cab896690
  • SHA512 5bf8d5cca7708f7fb4b5e249a63984ecc898eb10f4e9da910356819a0e5d3bd7e2a1aea3e2b9b8d7c15e7f4879c794d0c57a80bccbec82d08545d3d3798925d0
  • SSDEEP 98304:Gt56pzLT+JqUbAqFNNJkV08v1CPwDvt3uFUVCj75:4szLTkz8N08v1CPwDvt3uFUVCj75
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sonicstealcstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral17behavioral18
• • Target
    msys-gcc_s-seh-1.dll
  • Size 118KB
  • SHA256 b3717838904794d50cd2974bfa301574205bfaaf4609677cf201c850f96c12ef
  • MD5 4598896b75ae4f07a795a0e2920ba5ec
  • SHA1 157ec139ffe7597a7df1345480b9d56f8e383b15
  • SHA512 926dab24be7b819bdf559bc744d0f3eadd1a448f143be157fd960b67d047bb12c03035dd14670c5125eaedd34e91a3679b642376b0e1d3ac0ccb8f15e813c01c
  • SSDEEP 3072:TnOO4eJ1pgLNA8uk5ql0yyFvwvcfcMXOkFxKuKOHK/v:6OncNA8uk5qCyeAwcMekF07B/v
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral19behavioral20