Extracted

• • Target

    0x000f00000001201d-56.dat

  • Size

    550KB

  • MD5

    9dfbed115f029f3501c48806564ec04a

  • SHA1

    cf6538e6d6eec51bab88da3963260b9204158e12

  • SHA256

    09780015b2aeb7e82bdd67973f45d5eea247ff19057ed8be1c61d8c434983977

  • SHA512

    c4812f3fb9f89f65beefb972391fe58c4745ce221a24d8e597254f53d1f091e2178bb8613c35772ee0bb4aca7e5beebc368cd17cc07fdc82cc2fd1b2a0112be1

  • SSDEEP

    6144:s+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWYhJ6usHJdJUt:XPw2PjCLe3a6Q70zbpJOHit

  Score

  10^/10

  predatorstealerpersistencespywarestealer

  • PredatorStealer

    Predator is a modular stealer written in C#.

    stealerpredatorstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2