Extracted

• • Target

    tmp

  • Size

    273KB

  • MD5

    e795115169cc800de0392d6a675d58fd

  • SHA1

    8dd75837e360ba1cb8acf5a3d348dd020a5da482

  • SHA256

    17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e

  • SHA512

    5fb6543e91de175bd365462a1cc87d6772e43b0effd3757b3e408b08a4de5a004de9a85e7f1d09578fa3bc6b6486c5f5016c1b879496582dbb39b2e62e168f38

  • SSDEEP

    6144:s/wl9dobdtMJNPX459l2/FpnovRWf1RdSxWbkHg6O0:HdoRtMJRkQp2MY0QO0

  Score

  10^/10

  xehookstealerspyware

  • Detect Xehook Payload

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2