Extracted

• • Target

    253dc675eceaf5e241df64306d0de350af4715a0

  • Size

    843KB

  • MD5

    e2e8e1d58b06d7e05bef8c13bca92ab3

  • SHA1

    253dc675eceaf5e241df64306d0de350af4715a0

  • SHA256

    6532e16d04ebfc98395b0e06fb2c1210d5064dc242c2c374beccb6b561a58f6f

  • SHA512

    227b165ff0318d71416b5125bb7ff3b5e5c0099d558563f980a9c0d9d136a21f59794a0d47522e845fb92eefaf71a62dbd3f2568a3636d4096533bfee3bbe05a

  • SSDEEP

    24576:Dgh/1s5nyyx+NxEyafsab6JJH6UgLlrNsuru:ch/1s5nyC+NqyafsaGJJH6zBrNb

  Score

  10^/10

  collectionspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2