Extracted

• • Target
    Order confirmation PO 45003271..exe
  • Size 32KB
  • SHA256 8feeb31be2e79fc5c6ddd489dcbfe708c8890f107e32c788ec1b7842feead9d4
  • MD5 09de25091f6ec1af1b6cb9445ea8b15a
  • SHA1 b8f169cae7f09a1445828d09b8139b37bbc1811c
  • SHA512 41aa3e869ec8be3998ae5d50431d4f977dcb5ec14f99067ec3851e284d402425c07d38aac4042687a67e4e9cf0f6f5272d2dc8fb5a0ff92944894877d086097b
  • SSDEEP 768:8ma3IdUcpBxCQvA8OKtGbyukhKqeteXoJrRMcE:850zBxfAfKtGtk9weYnM1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2