Extracted

• • Target

    1d4946ea77a2bcf432f490d0a38429102a51069b

  • Size

    151KB

  • MD5

    f635582929e0b0f2f18e1ee1fb7a84e9

  • SHA1

    1d4946ea77a2bcf432f490d0a38429102a51069b

  • SHA256

    583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d

  • SHA512

    0a4ac0362ebf4ce81fb187d93898e3ffdf74e6a0da96913818ebbb59a236a3897ec680cdc4599a9cf8cee8f8b7d527c4fc0abf89016bab48449995d10065d1e7

  • SSDEEP

    3072:mQHKadVFHUg2HiFI9ifi5iLLbyq8QL+wI7BJlwEKctby:BqSF/2HQlLLbyq8QL+wI7BJiEK

  Score

  10^/10

  xehookstealercredential_accessspyware

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2

• • Target

    d1f0f17e91e91cc4e1647c2aa8a7f39af2793125

  • Size

    168KB

  • MD5

    8df48db76679f51e832e0b48a89c509d

  • SHA1

    d1f0f17e91e91cc4e1647c2aa8a7f39af2793125

  • SHA256

    771fb65b9e55db17bca18ea3594e8e8b4d5ef060919844c0641a02d9c3326b1e

  • SHA512

    0e387586091b5455feb19fdfd45cea73f425cf1b8cc8fdc11e68d78826e30f3d148731713c796c0106aee1e756c514fa8ecade656261edc517333245170596c8

  • SSDEEP

    3072:ELUbqjhjDUyx4HCIRoL57WpTlbYsb+L5QgDgZFHdrLTc5wEKctIZ:h4jJ4ORWpTlbYsb+L5QgDgZFHdrLTcml

  Score

  3^/10

  discovery
  behavioral3behavioral4