Extracted

• • Target

    749635fd11938a4ea105ad99f9a706d4a47890c1ad428cf6125958ddc1744fbf

  • Size

    771KB

  • MD5

    3ffad42e2e3cfd13037aa0533ed909f1

  • SHA1

    603014c761d72273b6dec968b72b7a3df8dc7c83

  • SHA256

    749635fd11938a4ea105ad99f9a706d4a47890c1ad428cf6125958ddc1744fbf

  • SHA512

    8cf29b5ea9c8190a36e4d32af0320add230a73f5479d1340dd42c3f9819c6d1c2f84b19a5e4fbabe854cb528c621b45e95949be1ffc4880d785c2f4312e22376

  • SSDEEP

    12288:uRYco+gunQUnykqVNeN24eq0P1FF/4mt6HhLJ:u2ZunQUnaVNeN2xnF/4JHhLJ

  Score

  10^/10

  evasionpersistencespywarestealerupx

  • Nirsoft

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2