Extracted

• • Target
    7ef71165b0dd233fd0f5642d2a4e1e36fddc5656a209236d80460d50417fae76.bin
  • Size 1.5MB
  • SHA256 7ef71165b0dd233fd0f5642d2a4e1e36fddc5656a209236d80460d50417fae76
  • MD5 3758fdfb9d7f2a7ea33de37f312b9187
  • SHA1 181aad55a1fe38dd5ec67dca6ebcbad2590215a3
  • SHA512 52e8c80ace120b0818f34559387acd4a7a3db0d6b6895447127681e91abab8040d989e059f6a01f12519dab25f1d9c49391de454953095527d78b59432ff6239
  • SSDEEP 24576:zCR9cpa51QhL5NrEs/dhYga/QBele5yKD9e++vRbui:zC/oanQjN3/dh+2KvRbr
  • TLSH
    T1D675280BBCD005F6D4AA9232896761517BB2BC490F3127D73AA0B27C2F727E49E75748
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  payload_v1discoveryexecutionstealcspywarestealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2