Extracted

• • Target

    517422af0bb3ad483144aaf489017311678f4af7cec58f5dafe68a0db9bd5952N.exe

  • Size

    596KB

  • MD5

    74ea3fe876df4812df04805cb921edb0

  • SHA1

    43ba407cf7cb376fbc9932eb6b3142a3d606bdeb

  • SHA256

    517422af0bb3ad483144aaf489017311678f4af7cec58f5dafe68a0db9bd5952

  • SHA512

    f3b26517d67c0843b1ef57a7059d11b51bcbefb07ee092946c36722e29cf7d7131473ed6e9ff3a37a1655258e03199b3ceeec3171e67efc29abf3b23c1408b2a

  • SSDEEP

    6144:Zs9C0eaieHm71o2pL2IMJDoMc2ZNu5GQpsnp/yFPMsXnQODVNIg+cTtgJ7AOyZja:Zs9C0eaieHmO292D3//yFPMsXkJ7MmkE

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2