Extracted

• • Target

    avira_en_vpnb0_19374396-127457345__pvpnws-spotlightvpnadw-test.exe

  • Size

    200KB

  • MD5

    2403072d939599e88431e5d0ed0e2b1b

  • SHA1

    507d6e48c7d74af7651a1af5e1d0844f45f9c263

  • SHA256

    5ad0285de999973d1a665bcfe5d7040494f64c113d8ef8664d3bda3ae66b8d67

  • SHA512

    5ecf81cd8be3ed57da1dbc063e517ffda89f4694356cd3ea5b2ea03c4dd53038a88655486e43d4f3d62c5b356072a6918a10b6befa7244634cea1d268aa111b6

  • SSDEEP

    3072:K73LYJiZfUO7JAkH+wWtaiYGlIQZboLRi9ua/aHyvh1d2itL:K77gIfU2T7ZGlVbA

  Score

  10^/10

  collectionspywarestealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2