Extracted

• • Target
    NEW OFER LIST 2023_01_23.exe
  • Size 564KB
  • SHA256 3c78328ece4e85f59c8cc9cc01d5cf600aaff4ae7aa045bc3ffc2a3d8f0fd708
  • MD5 76b3dd57391e2d2439b226172dbc3ce6
  • SHA1 c81a7c378867efc0e210579a4a93349e06f94ba6
  • SHA512 3a9fa7ce8bd253598d6718a087cdeda99e69cdc8fb255579cf117650ccfa8e73b581f9f824bd95a7f90de5018536dea7fc808c4b11d34dcc6e3bb68a2c0b4b5f
  • SSDEEP 12288:qduJ66BQCsOmNeg7kAgxe374MUgKBynt9ajXWa:1JVW3O4yeUMMXWa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectionspywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2