Extracted

• • Target

    SecuriteInfo.com.Variant.Zusy.478183.26222.24209.exe

  • Size

    721KB

  • MD5

    e6062652a956936758214e4099faabc9

  • SHA1

    960080862a56e9fa163e8781d82d09f74bea0f2f

  • SHA256

    6e47381a638f8ffd26a8009ddb73d38b63459161a0b9633b17445c49ffcd965a

  • SHA512

    f49713fc58c5ae99399ae168cbe0c392ffc0993a7fce84cc47d0cc5d678729de55a2bcc4b388cf8d740a857644a35a310cd88b552a64de37e162f24ca4c451a2

  • SSDEEP

    12288:5TUZ9qT9qIxqysfO7FWYEkG30I7UlwnSSZ1haCMbbCkKeK6DPJ:tUZcVxqeWYEII2XCQCkKeK6D

  Score

  10^/10

  collectionspywarestealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2