Extracted

• • Target
    bhatta.exe
  • Size 8.9MB
  • SHA256 5c113804b804fb934afe84965e69a2bd912cef31203b2e4f367d8986b8783c93
  • MD5 6d3ec0d0e31dc8d2e52d545f317a88fa
  • SHA1 f8f6dc9dd47c48a9e3ab66cf07bea628e4c06b34
  • SHA512 85f57b4140204ad8bcae9453e4cac26f946413bef0d7ab21d63bf07d4c946cd6ba86f966c66b35914d2c74589d3c4ec86699877b60aa164124a6746d9237567e
  • SSDEEP 98304:iYhWGQAd48yxltJMYYXyWgq8yKUU6FlvTAHSxXyhq:iEQsTyxlrYBgp1Ubr8SxXp
  • TLSH
    T1B9968B13AD9148F6C099A731C8B74256BA70BC4D4B3523D32EA1BEB82F727C16E76750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  5discoveryexecutionstealcvorishka_stealerspywarestealer

  • Detects Stealc stealer Version 3

  • Detects VorishkaStealer

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: VorishkaStealer

    VorishkaStealer is a Windows stealer written in C++.

    stealervorishka_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2