Extracted

• • Target
    DHL_DELIVERY_CONFIRMATION_CBJ120130222311011313.exe
  • Size 875KB
  • SHA256 b65c9b32608d8cb0f3fab995466eadf5461a471069dc7b801c3c5b14fa75fdb8
  • MD5 5b0f9640283d2c8e74e5249b7de1b9b5
  • SHA1 e49983c1eb115f23dd7750bd693a1c6906a8c1e9
  • SHA512 b70e740bfd0d6fa63eee042541a24323d933fe70a0e762451255689cf0251b90a23ab73e453e7ac4bdb8305d79a7b79b82a4786693ab60af65abe1017166ba38
  • SSDEEP 12288:s+jjZ9wcU6w+8SgQJa0FJPJ1MhwEILUDZOCoM+QLlgbiZU6XgS0OKPlGwZtDOb9:Dg60fQA0HRbEm0OmJlPXgVOKP9PDOb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionpersistencespywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2