Extracted

• • Target

    rsjdCM2RMfnXCCQ.exe

  • Size

    683KB

  • MD5

    4ed40e0cb4a5b2764737e1cf856a2dad

  • SHA1

    323d8187b737455e68c692c1cd4b8574a32f9712

  • SHA256

    39db2066b8753064962c5d04cc730b57075fa358976bfbd08e930bf7fc81e05d

  • SHA512

    a16842251d8b31f883c6c9afdd0e54ceb0c07ff19e2867913ab65972a767a2eb7df16655a1d0b1eec55ff8d2657633b0232a36e85d35599bae7bbd3a04a692aa

  • SSDEEP

    12288:WOmHFFDX21hED6Q+whWdevrolEuCAarSiX6Rlp0FnIGqHVgo4neVZJ4:hmXNNQdcEGuYqRl6nIJVgrneV3

  Score

  10^/10

  persistencespywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2