Extracted

• • Target

    0cc25540c7ea712231dfaa165733b316.exe

  • Size

    519KB

  • MD5

    0cc25540c7ea712231dfaa165733b316

  • SHA1

    2c4398ac4c7e4ea2605a7f9cd96b8c15db743e35

  • SHA256

    166af3429b6d9a81fbb537849190190516596c0c4a44be03728a408003039d82

  • SHA512

    34d25b55546e242e5940ee7c891fb37b2ad257a06b91d87e56e47385495ec45386accfb91d405cedd673b4507ede392b3533b1a218a94e90adcfcf432c697eb4

  • SSDEEP

    12288:+7Y8K9sEmAT2y/BAnHOZixIEjEmcEjElXs6Oj6EjE47AoKnWXyz2LRsYQG9e8NaN:H1+VC7b/lMh6QU9xTV

  Score

  10^/10

  allcomestealer

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2