Extracted

• • Target

    e338d3183fec33ba6eb7ff3143875770

  • Size

    523KB

  • MD5

    e338d3183fec33ba6eb7ff3143875770

  • SHA1

    08abb150c93eb17844552aaa9011442b73a7ce0a

  • SHA256

    281ca3e54eb8ab778b6675e367989a8672d16d4593a6e50f94044ee0f98e209b

  • SHA512

    ab05085f94a496cd884345e29b1849739cc1e18d6ab4e54ab80f31bfa0d20a7c5dfc7e31d71fd99e3657d7886e7ccb968a8b6c318e0e654c87390642ffb4248d

  Score

  10^/10

  discoveryspywarestealervmprotect

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2