Extracted

• • Target

    COBRA election-notice.pdf.lnk

  • Size

    8.8MB

  • MD5

    979d0840f1018723a0c2f1b38e053a87

  • SHA1

    bc00bc18122b597d5484d05f6f1df694fa9f9f64

  • SHA256

    17ad92c5d4b0707380de23f0dc97a7d50319d3f332be6a6d9cf30d239d49f744

  • SHA512

    2f6c2f764e0a9e057c25e32911721f47872e76b2cb9320342b7c221d088dab95806fc2d4499fa4151a508dc3a6fc35966d55410b6d53851cc1a382ad7c775729

  • SSDEEP

    12288:u7WDZ2e76xWryJabHBAWAzADGBUghdvfKKmWe4b3hZ1I/p1LBaYXK:V8IKLJZZ1I/pu

  Score

  10^/10

  marsstealerdefaultspywarestealer

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2