Extracted

• • Target
    5bf8a0725c6c82cc1f43b1758909e225a9ca95b2996731e0282318446164bb25.exe
  • Size 713KB
  • SHA256 5bf8a0725c6c82cc1f43b1758909e225a9ca95b2996731e0282318446164bb25
  • MD5 f4898a667daf07a95e19c650a9037711
  • SHA1 133ab960da7c762183a3f2a2d81ce15790570be0
  • SHA512 2f0432203906cf9cc91492a9a834ecbd0d2ffd80f7502788418c9e009d802012131aef3709f82a46b16fc950350dcd36f29987de61d1f2106a78292a7d147e41
  • SSDEEP 12288:84ett6hYrhZQL7X+oIQJQSsSjksPtLoNCgidV6SCryuqa8jOvsNs+:8tAYC+oDQrUZ1M0gyza8jOvsN
  • TLSH
    T1C9F4BFF475D4C522E51C36FA5C8924094D7A8D43F0219346AFB8F8B568B2B43FD1AACE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverycrime24_stealerelite_stealerw33dy_stealerpersistencespywarestealer

  • Crime24

    Crime24 is a Windows stealer written in C#.

    stealercrime24_stealer

  • Crime24_stealer family

    crime24_stealer

  • Detects Crime24 Stealer

  • Detects EliteStealer aka FusionStealer

  • Detects W33DY Stealer

  • EliteStealer

    EliteStealer aka FusionStealer is a Windows modular stealer written in C#.

    stealerelite_stealer

  • Elite_stealer family

    elite_stealer

  • W33dy

    W33dy is a Windows stealer written in C#.

    stealerw33dy_stealer

  • W33dy_stealer family

    w33dy_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2