Extracted

• • Target
    DHL_DELIVERY_CUSTOM_CLEARANCE140120222311011313.exe
  • Size 860KB
  • SHA256 1818cc0b97f34215f7b517c8cccf9b7d2c38df6526782c9a24a935e2f1f2fd55
  • MD5 72a8eca19f7d5b590fbbd85b1d7867d6
  • SHA1 6a27d25f4fc66e45a4f9044455f336c43946aee9
  • SHA512 b8f550680d4edb83879247ab5037cf23b40fe308841021071a480093fbb2e33953cba420c935e5237a7deedd81ac56e4e930c3430dae519fea4efced2b80b19d
  • SSDEEP 12288:A+arvdLZ9SGnCcouSbaZgvMDRRS8fqioJi9LOKPlewZtD:A+CLeGncuI+gvM1RSwqdc1OKPVPD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionpersistencespywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2