Exela.exe

First submission 2024-10-15 21:10:21

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 10594.59 KB (10848861 bytes)
Compile time: 2024-09-20 02:12:28
MD5: 83154f0731104f82b198eb13465dfa57
SHA1: 4462abc937541f0bde333e23b8b211dd34a3a641
SHA256: 54b94ac48454677fbf054ed12e93be43702df08e5376d9d547216e3cb75cb36c
Import Hash : 72c4e339b7af8ab1ed2eb3821c98713a
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 49/77 VT report date: 2024-10-15 20:44:12
Malware Type 1 trojan
Threat Type 3 cerbu python stealer

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://bulletenergyllc.homes/ken/Exela.exe VirusTotal Report bulletenergyllc.homes VirusTotal Report 2024-10-15 21:10:21

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x29f00 172032 2d9a342b9cea10af36a9defffc2a2fd763e338be a6c3b829cc8eaabb1a474c227e90407f
.rdata 0x2b000 0x12a50 76800 a92c4cfdb16cb478fdd72d0934f16288ffba50da 1bf0fdddf75aa54888ce69b8dff4fbaf
.data 0x3e000 0x53f8 3584 069fd3959f91e690643115a296bf21044144de01 dba0caeecab624a0ccc0d577241601d1
.pdata 0x44000 0x2250 9216 09c2a6d5404bc19e11f7eddad07a164b42b01ee6 181312260a85d10a1454ba38901c499b
.rsrc 0x47000 0x92c 2560 4d916d2ea3f44a467458413de04ad9c12627486f 24b055042a4a23be9547a9d642aeed81
.reloc 0x48000 0x764 2048 d73caf6099972c4407ac22954a7454e922084dc0 816c68eeb419ee2c08656c31c06a0fff

PE Resources 2

Name Language Sublanguage Offset Size Data
RT_VERSION LANG_NEUTRAL SUBLANG_NEUTRAL 0x470a0 892
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x4741c 1293

Meta infos 9

LegalCopyright: \xa9 Microsoft Corporation. All rights reserved.
InternalName: Exela.exe
FileVersion: 10.0.19041.746 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductVersion: 10.0.19041.746
FileDescription: Exela Services
Translation: 0x0409 0x04b0
OriginalFilename: Exela.exe
ProductName: Microsoft\xae Windows\xae Operating System

Packers detected 2

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ 8.0

Anti debug functions 6

GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Compressed
base_library.zip
bbase_library.zip
Library
mscoree.dll
vcruntime140.dll
ADVAPI32.dll
KERNEL32.dll
blibffi-8.dll
COMCTL32.dll
bsqlite3.dll
blibssl-1_1.dll
ucrtbase.dll
bpython3.dll
bpython311.dll
bVCRUNTIME140.dll
USER32.dll
GDI32.dll
blibcrypto-1_1.dll
7python311.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
discordnitrogen.exe 2024-08-26 11:31:14 2db515aa4c8ba2b4e6878e7e0b550c8f
tac.exe 2024-09-23 16:57:06 8a35be4e0576e642603dc78f07f32a93
Software.exe 2024-09-24 15:24:04 66c1d33fa2373f9f734336b87f123e31
st3amBYluxy.exe?ex=670cd923&is=670b87a3&hm=9d7dba21c2a8ad22d47f3edba77c4617ddfb3d025ff473df74bdf2b60f0c68d1& 2024-10-13 17:33:03 23f733d217275847ffb11bf97827dae8
freenitro.exe?ex=670c1355&is=670ac1d5&hm=fe431b2f20f8cc958563e6e904e1c828290ba1470a54a6f82725608fa4784485& 2024-10-13 19:34:02 8c9efd9a2d9d55aad11203cc4e3c816d
nitrobuyer.exe?ex=670c445a&is=670af2da&hm=1f281fd80c98af4f9fd87d76a7cd35a3e597b77693d1a804430d0000615d585a& 2024-10-13 19:38:03 32554d2f5dcd9927b21b43dda85359c2
mullakka.exe?ex=670c4027&is=670aeea7&hm=c37458cb8f8dc2985499fcc5dd86600a1dda5f7a724709109a97ae24970f4d65& 2024-10-13 20:17:02 136c7ac634c84ad86c1c7340c9262116
FreakyBrowse.exe?ex=670c18f3&is=670ac773&hm=3a26c3c7751649dfe642708c7308021483cb3a3e840a9d7ffd5fdf0ed02746be& 2024-10-13 20:39:02 a2728dfccca75072dd2f6c6a02617ee6
distribution.exe 2024-10-14 12:45:31 2cf67f645897af37ea483ed1aa3b2790
Wahiy_swapper.exe?ex=670e299f&is=670cd81f&hm=d668cc4432184523e29c1a622634c90477a431b1b18691a624773cd7989420a9& 2024-10-14 16:52:04 8e77547b14323977331594025634d90a
worker.exe 2024-10-14 23:10:06 5f08961671234960517cefb9df7a8c41
Rv2_Nuker.exe?ex=670f7931&is=670e27b1&hm=22265025fa8bb5baf986ff9795b8348e2c4fa24d4f6cced287e52fcfb45bf1e7& 2024-10-15 20:10:02 b459e3a71f72a9ac8a725144d56d1168
hydra.exe?ex=670ef165&is=670d9fe5&hm=d1114b65b18c8fc6ac378cf57169ad9d4f23499ced8ea6fe3b1fe96461e38a98& 2024-10-15 20:12:05 d446fa000d260aa78513d383874d82e5