Extracted

Extracted

• • Target

    10f2af74b935ffc5664a6a9bf0d141f30777e4211ef4d75ad65c6db77554cbfb.bat

  • Size

    32KB

  • MD5

    35dfb522fddada4616e915fb17888e31

  • SHA1

    8fbbfe83e8f5faa59037fbbf4fd97bc2c78f95e6

  • SHA256

    10f2af74b935ffc5664a6a9bf0d141f30777e4211ef4d75ad65c6db77554cbfb

  • SHA512

    9e35fa005d0e1756bcf45b43db52c7be1ff584f8cdbf4349c06d6cabdff03acd1ea32c2e3cfc72cbd28b7d41853b2e7c44784b5d1e585b7fae2dc480e60305a5

  • SSDEEP

    384:UuGq+dSBNrJ0AKr6CLNOPKQdKJGE9v62FTJsN/6SdRfIeq2sOGLtY6:mq+dSBNdBKrhLNJL8E9rTJsNCSE3w96

  Score

  10^/10

  executionpersistencespywarestealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2