Extracted

Extracted

Extracted

• • Target
    x47b7b72b46f239b740ad85ba1e4711f3ae07d69204db4c7924c895dc04517f2a.exe
  • Size 8.0MB
  • SHA256 47b7b72b46f239b740ad85ba1e4711f3ae07d69204db4c7924c895dc04517f2a
  • MD5 31d742b63836267c9be2d3ae2e188522
  • SHA1 09517bd4b6f48149ee95d2a4e22e53a62666c58e
  • SHA512 4f78e322ed350c0fb02e8b75458f5dcc9e2c6a9f2f3642b9f228401ca4ff4597d79fa9a2b871f775a37ac0caf3c93bb22bd8c9d953bdab5482e4673ac6b5a5d7
  • SSDEEP 49152:W3/abSUK+bUKWIENoqbzlnI6eaws8WYw/wBK5dlE6B8kw+qcymZyHcWC4elP/+:7SUhz8DyfeYug4vVqKaKBP
  • TLSH
    T1A486B24D771C42ECC466453200F60A92A774AA1A93F81F971BD69C744E222D8BFBCBF5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  282234crypt2rundiscoveryexecutionamadeystealcpersistencespywarestealerthemidatrojanupx

  • Detects Stealc stealer Version 2

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2