Extracted

• • Target

    d11c0f5febcc93e63347d730f9e7c841db54ec0c7e10a2c3a2bfaea6905e7782

  • Size

    478KB

  • MD5

    fb269d33b6d51d0e977e146a99871e64

  • SHA1

    17023d06e2c3555ece75bd8444e097ed0b2fe686

  • SHA256

    d11c0f5febcc93e63347d730f9e7c841db54ec0c7e10a2c3a2bfaea6905e7782

  • SHA512

    5b0586822c2ec136896975a7fc7af33974775d15e615ab39f1428c6cefb7a4ace98ad61548e91da63a013faf825148934bbf3942797321ce65dded142826cee9

  • SSDEEP

    6144:xYa6EL56cM62ctEasiaxcU+d/pY0jvs5jeQ4/EyBNvS9aQzT/pjnaS3kV2u:xY0t9Ez3xFspOa9seNvfIFjaS0Au

  Score

  10^/10

  collectionspywarestealer

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1