Extracted

• • Target

    Swift Copy of USD 11961.50.js

  • Size

    603KB

  • MD5

    fe8cfc59d5069342f1d6b42822ea2577

  • SHA1

    641c2747423abbf598148cfb1d1006becffb60bc

  • SHA256

    ee7711a9df0823e2f820b6a1cacc69a86c0694719ffb6373b6c5428c97d969a8

  • SHA512

    5c4408cc638d8484ad7f745b60ed4eb7aae7d911538ac986ed858fd93402ff1449f9d38e1f35bfac407edd920e1e3e386cf850db01d71eae6e40989b20ad7f82

  • SSDEEP

    12288:lHapg5WlvjbwO8wd8yTYhq6YGOx+QXVT5dmWIRXRBU6p9TY+lwhiaZaCLaP7OXXW:9dn2XzIVQ0

  Score

  10^/10

  executioncollectioncredential_accessdiscoverypersistenceprivilege_escalationstealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2