Extracted

• • Target

    PO698535787884.bat

  • Size

    618KB

  • MD5

    9041039000fabe2ec5a095d7466c2a63

  • SHA1

    0b5ac9c7ce086fc844dd9c8dadfa72f9c7cbd210

  • SHA256

    fdd1809f12f7c3da60911712659cb458ea68a10f2db7a08dd0b4a4d49c0ac7c0

  • SHA512

    0ab192616ade6c4349ec259b8155e90d0317e3590f8f9ec077f30f506fc30bef9f38e8cc76504f94ab16a02839140194c762ce5d212c28245e1ea113751062ed

  • SSDEEP

    12288:fM0yMLFPlP5ZkXrrTJ9i5ioy+zgDdCwTPIXH3tPO3QtQB8K:f7LFtnk7E5rzSdRPI5zQB

  Score

  10^/10

  spywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2