Extracted

Extracted

• • Target
    file.exe
  • Size 33KB
  • SHA256 96d6b0603a4a13e1f7636ec2cb9bc9b2a5491c15bce2c1daf9ace7b60cd20fa4
  • MD5 42d0dc6ac0930333c19955086bdc00f0
  • SHA1 880c9ea17b5286380a36461a52b9222411f555a4
  • SHA512 2d5077cd5a8494329d7bfddb77cdc778b1a65771aed537672c6af0c93ebbc5d16217e861a93a072d9ccd2f32afa74fd08e76d89d3df0491d985cf7d8a3041dca
  • SSDEEP 768:mnNlAP5jHPTjiBwEYkg3baAezJ3Va0H6+522QWOS0neIs:a45jvKBxKq35522QWOS0e5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vvcdiscoverydownloaderexecutionstealcsvcstealerinstallerpersistencespywarestealerupx

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Svcstealer family

    svcstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2