Extracted

• • Target
    RFQ MR 27136_XLSX.exe
  • Size 843KB
  • SHA256 6532e16d04ebfc98395b0e06fb2c1210d5064dc242c2c374beccb6b561a58f6f
  • MD5 e2e8e1d58b06d7e05bef8c13bca92ab3
  • SHA1 253dc675eceaf5e241df64306d0de350af4715a0
  • SHA512 227b165ff0318d71416b5125bb7ff3b5e5c0099d558563f980a9c0d9d136a21f59794a0d47522e845fb92eefaf71a62dbd3f2568a3636d4096533bfee3bbe05a
  • SSDEEP 24576:Dgh/1s5nyyx+NxEyafsab6JJH6UgLlrNsuru:ch/1s5nyC+NqyafsaGJJH6zBrNb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2