Extracted

• • Target
    240222-tqw9jacf89.bin
  • Size 6.4MB
  • SHA256 ac47a5b63c2b1049c4a8e6832484da1c10274a75d2512ce948320569d616f809
  • MD5 e21f8a92ef19be52eeb1bebf5aa60327
  • SHA1 f2bccc5b7820434d1508aabb51734ff14ba6a0d0
  • SHA512 e3477ce32c231a975435aea01d5f1fcba077eeddcf036c0a71128ad3285e752df57f90a999ad830d038a9de7ca40bd984ac56643e325b7e9312d3cbc45587586
  • SSDEEP 49152:MNFTuGJRa6Q+SvTSMD8P4xOH/WZc52/QXUXH+AJymcB6kschRW6Leh1ZNLl46GWC:+U1xU4/cYkXXc/XYE0T80oZLaSi
  • TLSH
    T1A1669E07F68149EBD45FC571DB4A5E23F773F84A0724B39B2B9836212F52B60AE19348
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionfletchenpersistenceprivilege_escalationspywarestealer

  • Family: Fletchen Stealer

    Fletchen is a Rust-based credential stealer targeting browser login data, cookies, extensions, and crypto wallets.

    stealerfletchen

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2