Extracted

• • Target

    2279e3a12dd54692c3599d976f558148ba1a6ce0ca4058cffcd1d00d31bf2439

  • Size

    114KB

  • MD5

    4a60a0407f0b836bfcba46581e7b1497

  • SHA1

    9373725022363230a486bde5d2ef4db295fa7f62

  • SHA256

    2279e3a12dd54692c3599d976f558148ba1a6ce0ca4058cffcd1d00d31bf2439

  • SHA512

    445fa53fa83a38a9efca13ac6d0321d52a174d073b170eec931771bb37fade3f0de15db6e74261eab7e5d0cca57150870b168d4bb51177b9d847972b471fd690

  • SSDEEP

    1536:GxgoGOdBGnY+1P75AzTliRVcwTLNZ/MhHPGbfSGZ+VLL3nNEYmYvwo:0aY307cwFVMRG7SGZ+VP9h

  Score

  10^/10

  credential_accessdefense_evasionpersistencespywarestealer

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2