Extracted

• • Target
    f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d.exe
  • Size 1.2MB
  • SHA256 f12dad8424c063bf17208e7ac36cbfa1740b3cbea06bb220e5f74456bf7c7b6d
  • MD5 f015b826d2f08e9ac6c1d1606e75cf28
  • SHA1 f2399c9e7280c2492d24428f2a2a15174e6dd9e8
  • SHA512 6fa5492100226047d20890327076dd2142a69f595462c64b6297ea86c44f0313ad6d3350c9fffa655a0056d7d21ef4b71b6c32e4ef3abcd2b9a1974ff273c03d
  • SSDEEP 12288:YM9SBLz+upKoUSEz3nvneXYkGm6Ojn35kU/zrRY51eJOsFPjXahG0ZIFpCYVIu0J:YcSVqoUSWXveXYk/q2BVJFPjQGv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  60951k6tfib72m8f1zdiscoverystealcspywarestealerdefense_evasionexecutionxmrigminerpersistencetrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Windows security bypass

    defense_evasiontrojan

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2