Loading... Additional Content is being loaded
Windows
Analysis Report
SecuriteInfo.com.FileRepMalware.22561.28030.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.FileRepMalware.22561.28030.exe |
| Analysis ID: | 1543665 |
| MD5: | aecb2c382b2181620aa3243dcbca51c8 |
| SHA1: | 9b103aa29dd1f39b7bb6261703f144bfdfa4a06e |
| SHA256: | 6b9568f25dba66dde3d01baa88ff15ce5165fed7c29c8446d8fab993234a49ce |
| Tags: | exe |
| Infos: |   |
 |
|
Detection
Python Stealer, Exela Stealer
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Yara detected Exela Stealer
Yara detected Python Stealer
Bypasses PowerShell execution policy
Detected generic credential text file
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Gathers network related connection and port information
Modifies existing user documents (likely ransomware behavior)
Modifies the windows firewall
Overwrites the password of the administrator account
Performs a network lookup / discovery via ARP
Potentially malicious time measurement code found
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Uses attrib.exe to hide files
Uses ipconfig to lookup or modify the Windows network settings
Uses netsh to modify the Windows network and firewall settings
Uses netstat to query active network connections and open ports
Yara detected Generic Python Stealer
AV process strings found (often used to terminate AV products)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Queries time zone information
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Console CodePage Lookup Via CHCP
Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Credential Stealer
Classification
AV Detection |
  |
|---|
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
ReversingLabs: |
||
| Source: |
ReversingLabs: |
||
Phishing |
|
|---|
| Source: |
Process created: |
||
| Source: |
Process created: |
||
| Source: |
Process created: |
||
| Source: |
Process created: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
Spreading |
|
|---|
| Source: |
Process created: |
||
| Source: |
Process created: |
||
| Source: |
Code function: |
0_2_00007FF7B2B683C0 | |
| Source: |
Code function: |
0_2_00007FF7B2B69280 | |
| Source: |
Code function: |
0_2_00007FF7B2B81874 | |
| Source: |
Code function: |
2_2_00007FF7B2B69280 | |
| Source: |
Code function: |
2_2_00007FF7B2B683C0 | |
| Source: |
Code function: |
2_2_00007FF7B2B81874 | |
| Source: |
Code function: |
2_2_00007FFD93D13229 | |
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
Networking |
|
|---|
| Source: |
Process created: |
||
| Source: |
IP Address: |
||
| Source: |
IP Address: |
||
| Source: |
DNS query: |
||
| Source: |
UDP traffic detected without corresponding DNS query: |
||
| Source: |
UDP traffic detected without corresponding DNS query: |
||
| Source: |
UDP traffic detected without corresponding DNS query: |
||
| Source: |
UDP traffic detected without corresponding DNS query: |
||
| Source: |
UDP traffic detected without corresponding DNS query: |
||
| Source: |
UDP traffic detected without corresponding DNS query: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
DNS traffic detected: |
||
| Source: |
DNS traffic detected: |
||
| Source: |
DNS traffic detected: |
||
| Source: |
DNS traffic detected: |
||
| Source: |
DNS traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |