Extracted

• • Target
    4e68c5a537320cbe88842a53e5691b7f1a590b9c0b491a12baaeeda111dcaa4d.exe
  • Size 210KB
  • SHA256 4e68c5a537320cbe88842a53e5691b7f1a590b9c0b491a12baaeeda111dcaa4d
  • MD5 51b0ed6b4908a21e5cc1d9ec7c046040
  • SHA1 d874f6da7327b2f1b3ace5e66bc763c557ac382e
  • SHA512 48ec96b209d7061a1276496feb250cf183891b950465d3a916c999aa1efc1c8831b068ce0fce4ce21d09677f945b3d816ed4040146462a0ce0845318041586a2
  • SSDEEP 6144:gQtdqzqv7rArb/LoEyavuW6uqQqNW14pv:gQtdqWk/LDmQqQqK4pv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xehookstealerspyware

  • Detect Xehook Payload

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2