Extracted

• • Target
    RFQ#GWP894664756757598757.exe
  • Size 664KB
  • SHA256 1326d9172aa0687e037a43b532cf2fb0e2ba90bff2e35efdebac87c3b06560f2
  • MD5 c09670750b9e0aae9606738056a9684a
  • SHA1 908ef7a167316525976bf3830d07f868b21ab0e7
  • SHA512 5a69351d87658cd130aee3dca3f7c3fc9ffccedad8ac3d45c4ea2846774a6e497ec5b6b1f74dc755260255bb1756fb2bc7d1c0f941df0c33c2cc8ced1da50692
  • SSDEEP 12288:Enu0bwjemtGw044CU9aMaiKaPAFnC97SaP6yeXQTl:E3bm8F9aMaiKawnCVSaSy8QTl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionpersistencespywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2