Extracted

• • Target
    Setup.exe
  • Size 4.9MB
  • SHA256 0311c3d5fa2bfb130b116344107cdb6ec1fd28775a51fd3f0effbac88a2e735d
  • MD5 ec2f07686c76280c7b2fb9d8b1e802cc
  • SHA1 99db9b22a79286868ec5a69de35e2692b3ef3feb
  • SHA512 ecd6c6a32f2fdf1c6796a94b2021189f40c1b2b6aa97b5635d117e90648c15b6d413f14f4f0cda835c1574864de1a6772943a4dba663cb7d1503cb8af9598bd7
  • SSDEEP 49152:QbQU1QKR2f+6acqeJyRxAacnr7g3PLdPhiCmjhrjxLxB+k7huMjEI1YH86jeUb:Qbf2XeUnkPLdPhixjpNLT1DYt3
  • TLSH
    T1C2367C077A9055E0C466DB35C1BA5263BE61BC8C973A23E70E60B2742F797D07AB6F04
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareeu1discoveryexecutionstealcpersistencespywarestealerdropper

  • Detects Stealc stealer Version 3

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Downloads a file with CertUtil

    CertUtil's URL cache options fetch arbitrary files from a web server, which can be used to retrieve further payloads.

    dropper

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2