Extracted

• • Target

    shk098654578.exe

  • Size

    405KB

  • MD5

    9a9100bb44845bdca0f6f2c7fcd09c28

  • SHA1

    da89801f49adaa1f864ba8ddb0c7526d1d5d81fe

  • SHA256

    efae2917baa8189a375577739cd5d6bf9b759ff81fe27b779dfa6b0d53eecea3

  • SHA512

    f12e7d9f5a55191c69be2ee09d95055c698e6488d33e77a3332a19714bc4b29147eeeb45e977a00c7f0f7c89ad182a84417aed8db838e0cfdd73b8327a1e8245

  • SSDEEP

    12288:VId24YQIrcxfY/5jfC4EONn0zFQUOrBN:VTYIwBY/5TNnWQUOrr

  Score

  10^/10

  spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2