Extracted

• • Target

    942b4d63baab1353006c18030d90a594fbd230223b82524117e853784ac1a2a4

  • Size

    1.0MB

  • MD5

    7ac354cd42c2aee067b0c121bcfe71d0

  • SHA1

    9c095975d1546e101755b3d23d5c31da597fe111

  • SHA256

    942b4d63baab1353006c18030d90a594fbd230223b82524117e853784ac1a2a4

  • SHA512

    68260ec1b9af9d061e28eb888e0f0ca6d4b6f9e62304658d35750d566ae9119aaaa27b68c4005b9941f7c960cc8e4e9060c0c88f28c56ff4d597485cef2456d5

  • SSDEEP

    24576:fDzRiQ36E8v/O2TlgLCI5LON9R4qXCd0mYESKoTGg3pfcSd:ff538v/xlgR5aB46Cd15NiGipzd

  Score

  10^/10

  spywarestealerupx

  • Nirsoft

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2