Extracted

• • Target

    supermain.exe

  • Size

    541KB

  • MD5

    2f61a2fdad0599146e7546d577d3772d

  • SHA1

    281a57e57f2b415c35d5808f890da7e172a1a281

  • SHA256

    2ab5dd6218935db97e71e5578ceaa8f87ef7ac30574216662dc6c040136ff5cf

  • SHA512

    2830d7d546177138e0f6d2f02a47abe3bfbc05d776ea81780f0f605fe458811c67124e34cb135652f1e6a5a72b62a99640bca8796a3c9fd0360b50b3fe808dc3

  • SSDEEP

    12288:GCWMqsBLwNQD8gABE3u5p+hY/4ewg2ZNaKCmWyOfoJVtKtnjWGuWgbHOuSMqT/Yd:XuSOfgAB0

  Score

  10^/10

  discoveryxehookcredential_accessstealer

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2