Extracted

• • Target

    fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.bin

  • Size

    120KB

  • MD5

    8950fcf3617883788286cc40cc8665f5

  • SHA1

    b169be225703daefcf7d236893ae55b5cc774dbd

  • SHA256

    fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a

  • SHA512

    ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3

  Score

  10^/10

  allcomestealersuricata

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

    suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2