Extracted

• • Target
    fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7
  • Size 1.6MB
  • SHA256 fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7
  • MD5 db995e4e62657669b26416255830e024
  • SHA1 7a868f209d70ada868b94375a4587c5dd166ab4e
  • SHA512 c4ab12b257335b1f59c83e2f894535b6d1733dbd884f005b4b9ce824b80e085b838d0ac7b1700122656a4cd1d8bd5d398a22cbcccc8e2a155ff2106e88f63ba4
  • SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  collectiondiscoveryspywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1