Extracted

• • Target
    SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170.exe
  • Size 2.2MB
  • SHA256 a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06
  • MD5 75914207c89e01520ec7905774192f04
  • SHA1 e8e1b890692083e893de4c8eec718200ce00ca14
  • SHA512 f025a3223195b659f0af309865cb08607aedc597d67e666b3afc00aeb4a3d795c4d608382ab25c0458ee38de98cd308953a3c3070fa47e69295f154cbd67a3f2
  • SSDEEP 49152:ZaBNlIwxb3uCrb/TMvO90d7HjmAFd4A64nsfJt0udLClUBr4HyfZhsRoYg15Q6Eb:ut3unArwYh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptdiscoverydownloaderstealcsvcstealerinstallerpersistencespywarestealerupx

  • Detects SvcStealer Payload

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Svcstealer family

    svcstealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2