Extracted

Extracted

• • Target
    HotmailSoftware_v2026.exe
  • Size 62.5MB
  • SHA256 9961acb3c061db6a3da62cde734d30ef6c2cc156906bcfaacc91abf6cc52e1bd
  • MD5 a623e6b6c4022a0474dfe92cc5deaffb
  • SHA1 d1c18287886d0f2caed377e6bfe9cb9712afab98
  • SHA512 ccb515762200d720cb14528e70d31be7f5aa078bbbedbb8912535a2019308af04d626a5ec1ecb7ade5a810ff06b3e21dce1840a68e06683b6738ada84d7d7480
  • SSDEEP 1572864:TAsj4QHmgY6E4vPRMSIGShXwJRvbv3U5k4:TAssKhYyhMH9ERTv3u
  • TLSH
    T170E733B4C6085553F9933D72D7DE711F325BDE424E460FD61AAC728A2B5C202CF0DAAA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  rundefense_evasiondiscoverydownloaderexecutionstealcsvcstealerinstallerpersistencepyinstallerspywarestealertrojan

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1
• • Target
    database/db_idtienphuoc.sqlite
  • Size 21.0MB
  • SHA256 b78dda5c35ab2d7c6ca760dbae2f38561d586ff06a24c5dbb77c1af960f265da
  • MD5 1a412cb0302561f3e18818e4659c5319
  • SHA1 8771aaa01d13ab53ff88fb9701d92d2caaff4651
  • SHA512 e86b72866682f5bb72a0b4d695c85e186934fde91e0b6d59b28914296d7422b0fa0ec8f996e7076c989c59c4bed6b604b953030ad42ec1576434e56551f9335a
  • SSDEEP 49152:zxu3rzQUxqV14kkkpcQEpsPGlcKCjAwFz1QVwTQ9kcc+2jUyNbbzaaplWC1GxZyv:vf39e3di7
  • TLSH
    T184279E73A13A365CFBFF5B7F48ADAD295C13291B7FF801B8C6D86C468812509A43E419
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral2
• • Target
    database/db_idtienphuoc.sqlite-shm
  • Size 32KB
  • SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
  • MD5 b7c14ec6110fa820ca6b65f5aec85911
  • SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
  • SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
  • SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  execution
  behavioral3
• • Target
    settings/table_columns.json
  • Size 273B
  • SHA256 1b26988fb26c08f45d7f7b0c57152073de1bf2db730b6f3299595599c09ef6fc
  • MD5 7c305055af5941aac787ec5a50abfc8f
  • SHA1 92bd5028394b82ffd2240afc7b55d1623e849d02
  • SHA512 810440bd94f5b59374b51f296c78297948f1ad4ab91f62a64dc8a536aeaae5201635060282a278ba5561c0f5e30244c3fa396f852d81d6708370df2e2db23f8e
  • TLSH
    T1D7D02B42823EC93409F5A17368CCB8091EB3CE0C4AE9632CA9934209843FB2F30BB4C0
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral4
• • Target
    version.dll
  • Size 19.2MB
  • SHA256 fc299c8c6f97e449a03f0eaf98514efb522523a74e50345c3e3fc4e553d8ff5f
  • MD5 b1d5cb0c98f65703c48f5d3d9b22546c
  • SHA1 f9276116e01f9fd5a1830c4217526161c23abe4f
  • SHA512 0208c33f94a4ae072ec9a046e15c0c57faf99e3cde8d29f80becb4ab9607045cad729fed55dedd773da4f8c7b7edf14f7fa7b3a5225f980fe3f692c9fa33aa28
  • SSDEEP 393216:UZIDNdsmLcFHoIuZdfb5XntCqPsmki/MNHiQGrrBYL9WY0nfv3gO:B3sGc9Z0BlgqPszMMFCrBI9WY4v3
  • TLSH
    T1B61733C751DE57ACD2834788A98723C768C4646AD9EFCB2439C74C02B121D9986CBE7F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral5