Extracted

• • Target

    PO55453657675644bat_JC.exe

  • Size

    661KB

  • MD5

    a29c00073b51f8a2087cde792553b9ad

  • SHA1

    3a973a796798bcc13e0efd14e44315c4e4d70c0f

  • SHA256

    7bf1b9e7df8d0b024322706a790fb37d8ee58c6278f597154c902dc52bbc70ca

  • SHA512

    24b142dbf99bd03a58dfca4c0e5cc3157981609202a38b58d1f8d656b40f562e7cca45b2543f4fef4782b564f9a72aaecb52e0646e89a44872f624f30de1d4e1

  • SSDEEP

    12288:hiMC/jox7gnCnXOUiBVa03DysP+qTkQ3fRVWV9v0L36ySrrl5/uNul3:eLoxknUaxDdP+mv3kJbdFuNI

  Score

  10^/10

  spywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2