Extracted

• • Target
    porno.exe
  • Size 68KB
  • SHA256 f57af4ba15ac700989e7253dbb189c3dbeb3bd42d2287d4c4e1fe64facde5b26
  • MD5 e4bae86ddc6666a4115f3e7610ce4af0
  • SHA1 8eaaea1dd100b8e43aa9cebd977f94ae7731e6fe
  • SHA512 717d9e918211d7ecce04c73fc6b2ea1ab652a1074786dd8f9874afdb720d3cb05965fdbffa686898b0c393a9b7f043be017c5f57fe60308026a46f9c5b395406
  • SSDEEP 1536:A8GmIoN36tEQviFw1YcQQBnvbjfLteF3nLrB9z3nMaF9buS9vMe:A8GmIoN36tEQviFC7xBnHfWl9z8aF9b+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  bootkitpersistencespywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1