Extracted

• • Target

    630efa1e2dc642799b867363bb36d1953884480ac29942a1ab20243a8a9620ad.exe

  • Size

    278KB

  • MD5

    66a3124fe4ed45fae20e2bd4ee33c626

  • SHA1

    fc5ef4caf4d8a51a340f6fd98ac525debcff8f30

  • SHA256

    630efa1e2dc642799b867363bb36d1953884480ac29942a1ab20243a8a9620ad

  • SHA512

    569bc064f465c32fd11fdd67896106778f13094e20adc739d8824f9e02508701b712bd3cfdab48782421b35acebe16bb5b0e97543db869ecaec5c1b87902b872

  • SSDEEP

    6144:sU0sd0bzy1GOgofaePZ3e5fv+vc6X+olz:XzHGOgovPwcXbl

  Score

  10^/10

  predatorstealercollectionpersistencespywarestealer

  • PredatorStealer

    Predator is a modular stealer written in C#.

    stealerpredatorstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2