Extracted

• • Target

    Cheat.exe

  • Size

    305KB

  • MD5

    5a54c4466bea3ff4c9b82f290f46c64c

  • SHA1

    5065c65911b019215bb9a4b01274f2847796183e

  • SHA256

    3974d051f1e07090bc0e0ca46f7a1268dc91e6e2bd2ceb2855ff36720d7313ba

  • SHA512

    420c765462ec052fb41ea2ed1fb04f9db919d533359adafc75a03d91f53cc53c6e30e20cb3c9f6db8926af3b88c7bdc70e10c78c57459c8b088aa825541ce750

  • SSDEEP

    6144:25LngjinXjXuZzmrQoO778LVcXneHDKcVAqR4NZr/SAI76MfXyHeC6up:2Zngj8kP8LVAnejKc2S2E+ipup

  Score

  10^/10

  xehookspywarestealer

  • Detect Xehook Payload

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1