Extracted

• • Target

    hellres.exe

  • Size

    1.2MB

  • MD5

    2511d20918fe5495f4cec12ed8e010df

  • SHA1

    1a1d3f5c67f93021868e9fa4682f576f482ba86e

  • SHA256

    0ab815e72b9490ff95cc216c08aa6503d1610e052793d433732a3b28c25c5d71

  • SHA512

    849994cd3e0aa394041f0f23908fdc2440366685c3a3035c224cf1048f7eb73f6c30ac670de72b9a276fe080e965fba3b500d0c49dab91892683377b9db90402

  • SSDEEP

    24576:c8wnXXnncHLI8JQpP0s9MjemJ5lx1w6Qh0lhSMXl5vTOd:JMXXncHLIJss+egDx+6lpvTa

  Score

  7^/10

  collectiondiscoveryspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2