Extracted

• • Target

    37591b957e8d12af6cacf989bc62649a.exe

  • Size

    1.1MB

  • MD5

    37591b957e8d12af6cacf989bc62649a

  • SHA1

    411cee49999b094d1ebd6c81342e11a57389eb94

  • SHA256

    135e3c344b74bed9c18fdb9749a9bff77e7925501d33acec9fbe49495cb56b8d

  • SHA512

    fe5d422bd3a20d662a2deaaad9ef94a8a218f620ae444276fad340d894acadbd5bdd0d761bd20851c433ab8278ee45874c6ed0bed3cb83123e732aed60bb86ba

  • SSDEEP

    24576:ENCeqFPo//wnZJ4EZw2/jxTjUDnAmTtP3G9o:vm/mJ/jaDnFvG

  Score

  10^/10

  allcomestealervmprotect

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2