Extracted

• • Target

    98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da

  • Size

    227KB

  • MD5

    a9ac04a4a30fcf7f57fa94e6bff411fe

  • SHA1

    4c44ef0ec8e8a8d74497d4548f07ff86d6d8426d

  • SHA256

    98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da

  • SHA512

    ab757b0698a72403fbf95612ed28aff4df090590f6121d20cc321931d196af4d8602994b6fb2bff876406fb69c917b2bb936d82fa56b1ebbb4a1e253a0bfa523

  • SSDEEP

    6144:5nllcE8uegM8zBQC/KGKAQ4lOjoegzGXgrshUN8:5agl2C/KGK4lNegzGXgrshUN8

  Score

  10^/10

  discoveryxehookcredential_accessstealer

  • Xehook stealer

    Xehook is an infostealer written in C#.

    stealerxehook

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2