Extracted

Extracted

• • Target

    023548a5ce0de9f8b748a2fd8c4d1ae6c924c40acbde32e9599c868115d11f4e.exe

  • Size

    30.7MB

  • MD5

    9650ac3a9de8d51fddab092c7956bdae

  • SHA1

    f52b9ec5b9629a746c679394953dc56407b8a419

  • SHA256

    023548a5ce0de9f8b748a2fd8c4d1ae6c924c40acbde32e9599c868115d11f4e

  • SHA512

    82cd32a8b5b84c067a7a7989831041b4453f7ed7cc5ee4308e7dc5e495410267e03b6ea9ad3441adfa5e0313e274b2f43976121959d2c72b80d00719bb91d14e

  • SSDEEP

    196608:TQ6kL2Vmd6+DXLZy7YM30Lzajzpj4sd5bL:vkL2Vmd6m70Gzajz9Pd5n

  Score

  10^/10

  pyinstallerspywarestealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2