Extracted

• • Target
    Remittance copy.exe
  • Size 888KB
  • SHA256 01b0e10d7351007133aa2a5f1cef379b855706256fb70f327990ea142df772ad
  • MD5 c1f50910dc065d7b721c7a01dd1a169b
  • SHA1 f5312a469b3e0bb284b70c55c8444ac5ba281b64
  • SHA512 6e5ccb41d7f7fb0cc3a557aa3a326a82ffa01474bedbfca60c774538f558906b2f1d88ad89a03f4f651eb59abfc9871b8889e77ebf4958caeb5c0064037933e5
  • SSDEEP 24576:iBLepD6b3ewHdqoIaIDdz4NWSACe2s4LzIAkPD:iBLNb/74t4NWSAdqDkPD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionevasionpersistencespywarestealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2