Extracted

• • Target
    f76c4cbfd0f66af33781adf386474e1d00a76d98d822a41fb6092d27c5726cb6.bin
  • Size 1.2MB
  • SHA256 f76c4cbfd0f66af33781adf386474e1d00a76d98d822a41fb6092d27c5726cb6
  • MD5 2982ff0fef24030a073aaa20c7e91ae1
  • SHA1 5b7136632414ea4e605fd353518367eb855f476e
  • SHA512 756988d94801b135dcb07965c1d67e51adc6d08db4504f453db52a7a4304622a3f942c87a4f671718e1c95ff98f50786f96505ef0959417e2b8f50fa3efaf7d9
  • MD5 SHA1 SHA512

  Score

  10^/10

  allcomepersistencespywarestealersuricata

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • Registers COM server for autorun

    persistence

  • suricata: ET MALWARE Known Sinkhole Response Header

    suricata: ET MALWARE Known Sinkhole Response Header

    suricata

  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata

  • suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

    suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets file execution options in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral1behavioral2