Extracted

• • Target

    04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665

  • Size

    162KB

  • MD5

    0d248e0a41c1da11b7edd7c25e0cda70

  • SHA1

    267444ef2f574cc4f6fe398e35de8fb51c6d17bc

  • SHA256

    04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665

  • SHA512

    95adf4138f8e5ef50601d4847359381c3116cb5d3dacb5182ee04401ce4769a5cc2d551e53d5c892f32d2cb929863c6e8e50e325faf07e63775cd4976d3135fd

  • SSDEEP

    1536:z5FnyPehHeSePaZAtgDUhuv+B8RF1JdOIm5S0IX1BZYSxUKwmmmhY1T9F5Pva+gw:3nyW3e+AM2EJxnBdw3uiTL+tyVVO

  Score

  10^/10

  spywarestealer

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2