Extracted

• • Target
    Halkbank_Ekstre_20200916_175424_052121.exe
  • Size 908KB
  • SHA256 ce073fce9de335c288fe205d5bf7fbdd9fd3ecc718821116dbad098f176a69de
  • MD5 4ef03f2d952ac15ca8ab890de1be2d95
  • SHA1 9cea9b6ccd3ece0b7ad8a9058cba4cd3d016a9fc
  • SHA512 9c938b0f0cb380e57cef08e8b7d3a0913c4b474b4ce533b6f165c9b8a844309186aaff5c3c83cb7195e8360d8a4b7830a14586e79765721573bcbbcfdbf95e06
  • MD5 SHA1 SHA512

  Score

  10^/10

  spyware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2