Extracted

• • Target
    x86.exe
  • Size 3.1MB
  • SHA256 80b64331aab73ae1cb476c6a1dbe804abf304fded3d52303a700524e8370c92b
  • MD5 b3c956a1ff7f13abc16a17f2d4a7ad96
  • SHA1 4464cff6a27d5df56f6ec66dfcb9a3f2f520fb6d
  • SHA512 d84097b5e0bf4c6338ced46dd4ef2640a226783cffbb76f4f9709baaa3652c2aaaeb75bb54628bdfbd30c629e5ea85a4b9e96bbbbfe87690f6a3ec4d9cdd7c2d
  • SSDEEP 98304:+DWdFhBNzI4WlLOl9jHsYaJ4sWNR2X60U9M6/AVo:+KBNzI4Wlal9jGtWNR2K0O/
  • TLSH
    T197E533DA1B9EDE22DA50173144A3D7B5B370DE48B233DB545BF9AC87B035B38AE18601
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerstealcspywarestealer

  • Detects Stealc stealer Version 2

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2