Extracted

• • Target
    Read Message Delivery Failure Text.exe
  • Size 607KB
  • SHA256 f403d42973ac773f89be5f033e0ab6268e0078dda5dca6301ccd4924fbe9ec76
  • MD5 c8b5f9eb79068c5f1409a1a48b7a86af
  • SHA1 4f071f579280335994b01b494c19c943f71b0013
  • SHA512 9005095e0c3a757242d34a92925fbf2a2c6c531182938fabd44e993ac92f438ff1d10121133cdc440dcc36eb13361fab523bac275cd3bb0b6d7f6e955b09099c
  • MD5 SHA1 SHA512

  Score

  10^/10

  collectionpersistencespywarestealer

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2