Extracted

• • Target

    Open32.exe

  • Size

    252KB

  • MD5

    a4939552fd49c815275f8471aa690e24

  • SHA1

    b25e32b28841d3a313df3214d808630de52171c0

  • SHA256

    9b213c9bac7b804d065dc1e4ce1d30e14da812d9810c33544f9d252147c4846f

  • SHA512

    ab7aad4c27751b4e9ba91bd8a2c11f6ab11ad2eec63d66d0f174c58713380f0ee267a65e495eecc736e1aae258ffa039e4e7728560bd49b91a9eb4a8cf2d577d

  • SSDEEP

    6144:euGQdkTUGJXOjv5o1SDQkdvuP84zyU/49eK/yB4ar:XGSkTUGRODekpz4zq9eK/yB4ar

  Score

  10^/10

  phemedronespywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2