Extracted

• • Target
    Shipping Documents 2906381504.exe
  • Size 1.1MB
  • SHA256 267a95b7715bba494b96ff9d7bf29dfd8ee2c73c5312964b5039962826ce6fc7
  • MD5 76ae311a63da4f36f1eb17ab7f6c33e0
  • SHA1 604a6fe077cfb17e84871731bae9f32807602a95
  • SHA512 3e8c178b6297b11e0b7435311165d6d36d8b6d9c4340c3b81afea1120f1c637ffde479854d8a61d1aa49f78957e0400ea7e70eece5dfd8c65d7155bdf1c893a2
  • SSDEEP 24576:Jf+6UNxk0J9sB3B0VNmysyAWj0Ukp/Z9VsCidVORBKYt0XP:JG6U80JOB3B0VNm5FnpxoVODtIP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionspywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2