Extracted

• • Target

    4e68c5a537320cbe88842a53e5691b7f1a590b9c0b491a12baaeeda111dcaa4d.exe

  • Size

    210KB

  • MD5

    51b0ed6b4908a21e5cc1d9ec7c046040

  • SHA1

    d874f6da7327b2f1b3ace5e66bc763c557ac382e

  • SHA256

    4e68c5a537320cbe88842a53e5691b7f1a590b9c0b491a12baaeeda111dcaa4d

  • SHA512

    48ec96b209d7061a1276496feb250cf183891b950465d3a916c999aa1efc1c8831b068ce0fce4ce21d09677f945b3d816ed4040146462a0ce0845318041586a2

  • SSDEEP

    6144:gQtdqzqv7rArb/LoEyavuW6uqQqNW14pv:gQtdqWk/LDmQqQqK4pv

  Score

  10^/10

  xehookstealerspyware

  • Detect Xehook Payload

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2