574559b5c577dd824460429fb5b74c33e96203ba75ae9a3b5c9cfaf077f2bb17

General

Target
StellaGame.7z
Size 129.2MB
Sample260818-pcw96aap7t
SHA256 574559b5c577dd824460429fb5b74c33e96203ba75ae9a3b5c9cfaf077f2bb17
MD5 4dadf6ad783739c05dd0b44df385f4d4
SHA1 584e9e3220a5d8c79d393a53e95e073c3e300146
SHA512 e7ad951bb36dc6376bdfb79ed6d74720d6f9c675f99eb44d98897b6520c18abc364ade989eea5c9ddcf00209ef4a2cb5b24b7325e8d57422181f640b81b58b54
SSDEEP 3145728:Hpm1Akt06sBD6s7NsNzVQFquP6B5YhEFwMIVky4AfIsWjeEJje:Ct0l6siNzVQFquP6B5MEyMPgzWjRg
TLSH
T17C5833E71A53E908D25480B80E3D2DFF08BA7E5C27DDA24F718D61EF34C4968EA491B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  StellaGame.exe
- Size 129.4MB
- SHA256 42f2898b60a4447615c81e80352e773c5be2bae886748cedbdd0adcb86f70893
- MD5 71a0668a84ae48db369a4867a974e5a2
- SHA1 af2f8a0de8c7d972a9a8a00119993d48f6a23083
- SHA512 cf97d82b14c7e88a30cb313c26006cbf75edac79fe2d5d041552ce82e6eca4bd692788f520e4b5fb2e31c1e3aca4a62d804c9e6af37284bde0b41021185777d3
- SSDEEP 3145728:vksMatatIc8QPAwIFugw2x4IMDBgI9/a1JOcO7qNox0R+Qckk7:natjPANugw2x4IMDBgg/8Jya7R+5R
- TLSH
  T13A5833E71A53E509D75480780E3C29FE0CBA7E5C27EDA24F718D61EF34C0968EA492B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1
- Target
  StellaGame.exe
- Size 215.2MB
- SHA256 54935022a3d1fc1b0dbc9b6aa5278adeddaa9b89e4049afa085b8784554c2b99
- MD5 6bf767972eb88ffd19c5c661ab9e961e
- SHA1 e66142acd4c82c03b405fd0c90b916fb586c8bf2
- SHA512 a39899fbd1d6e06f233332d902fa8d7e3a7a3a9525640f409a0a5bf4d2df9c75311e85f3639eca593c263c596626c8a5d440a86c1bd94fac55f23a1c99a5c9ef
- SSDEEP 1572864:s8uXmfmOYq0ICLp1Y/T0M7Sw0IEEvvVjIGnXiv4X1XfN4dlM7x1pYEUgb8D7TIjD:nm4CNsP7/cK
- TLSH
  T137B88C03F29641DAC05DC1B98B5A9633FE71B8454B24A3DF2B5447922F66EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral2