Extracted

• • Target

    04f2e728cb9c631c92f2b9e03f69931910866269d8f4723d8e33d4eb124c45ec

  • Size

    598KB

  • MD5

    4c0287584692314400f8051a8c734e95

  • SHA1

    249e0641abdd69d0083eacb350b099d872211f8c

  • SHA256

    04f2e728cb9c631c92f2b9e03f69931910866269d8f4723d8e33d4eb124c45ec

  • SHA512

    3b424b7289ce6c6c1f9bd97c2cf5144b625299e50babe4afaa62981af1ddbedd40fe4c8bbd0d369e31d5d96e343101f76b1d591f709c6e423855a96865e45e85

  • SSDEEP

    12288:WGKC2l0k5OFLSd28Wia/Lp5nE9ufGjG1o2jTtNELaZ4s4smIYfPahsqxFvhPToaN:7rI7XgYY

  Score

  10^/10

  executioncollectioncredential_accessdiscoverypersistenceprivilege_escalationstealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2