Extracted

• • Target
    689ff816fc3db38894e81abbdf63c02b.exe
  • Size 549KB
  • SHA256 f2ebbd96f7cf19aa8cc8b1273d1f80169de93ac4dde951ff4547177a11010945
  • MD5 689ff816fc3db38894e81abbdf63c02b
  • SHA1 aceb8ce81d4724d77a1b3031015f6e60d1139352
  • SHA512 b7eefa534ab5b409718d8b2287983417299f78bfed6696bba1037d3c816c3cadd172e5d59b0ff6e4ee8abf340cbc396c1695a075e747030fa7f6d2bfcfb8ef4c
  • SSDEEP 12288:MzW5JeQqp6xEWEoiH5KlCrX4FZg40rvM1BCpkLDapAGEhoCXOfNw9lu+eqQoEzwz:MzWCKlCroFWHr6BCCXau7X3pP7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2