Extracted

• • Target
    7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c.bin
  • Size 6.9MB
  • SHA256 7dcffe29d07d646b361b1bff52dfebd9747e766971d0284c788baaf38631ff5c
  • MD5 f2fed264a2e126a9f4ad784a5d211eda
  • SHA1 53a5f7f9f94488f498a9a5cfcd5857b2f1c1315f
  • SHA512 148f563742587bcb38dc3593daed79ff1f94d618ccde2a2e77b23f7daf478dc5a663174f2c75bec5d4ccbe820f8ad9264aa96e31c63c8ae44feb37a9b9197052
  • SSDEEP 49152:qhy0aoBhmmIkrb/T9vO90d7HjmAFd4A64nsfJeqvpoSFgxT3M6iUbEAGqr89nK97:4mIZjuEyE3dAhM2ACgMaWxf+G8MQGdTs
  • TLSH
    T14C765B03B899A1E4C5D9D63085368293BA717C884B3037D32F54BBBA2F767C46EB9354
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionstealcpersistenceprivilege_escalationspywarestealer

  • Detects Stealc stealer Version 3

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2