Extracted

• • Target
    2026-07-19_13b4f73885f424f73207481d097109fa_cloudeye_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver
  • Size 5.9MB
  • SHA256 72ba37f28406579b8556ca03137e7c2c4bed79e5fc875e560c017f161840fa65
  • MD5 13b4f73885f424f73207481d097109fa
  • SHA1 83f6fc356e93ca5c6a731387a38b88a761177b0d
  • SHA512 449a77ed85f514b34c3f9f7a947f3b4cfc7b02c96be6a12e4ad328ffa4a2acccbc53ec0d3254cc9cdf84e59d135d95a4d12ed41e5bbe0d456e1e068f122bc3e6
  • SSDEEP 98304:shYuzU3A2HSIc+9nclWLlBF+4h0dMXo32eKjJQh3+zZunB:suKy19n6MlBQ4GR2ZJQh32c
  • TLSH
    T10D56CF07FC9148F6C0A5A33189B696527B71BC091B3237E72E60BB782E727E16D79704
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  2discoverystealcspywarestealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2