Extracted

• • Target

    8b93ca9fb6445b74b0f616ee70a8d8c3888c9e4b8e2c0c1dbbab083208927afb

  • Size

    729KB

  • MD5

    f3399cb8b439e82e45f299b7bbd46f44

  • SHA1

    4938689820a0e0013883fd66b577f59c47125150

  • SHA256

    8b93ca9fb6445b74b0f616ee70a8d8c3888c9e4b8e2c0c1dbbab083208927afb

  • SHA512

    30045b4bda05130917e3c31bb4c8f3e36c3254eef92ffee63248f4af06da117a3af686370fed8252405c43ff7de8fcec171709b886db04ca518ef4346ba5586b

  • SSDEEP

    6144:QWusAIFB++velibxPyp/64wjOjn6cB3rZtT/Yq3v9Auky+4N1v9DI:Qz7IFjvelQypyfy7z6u7+4Dv9DI

  Score

  10^/10

  collectioncredential_accessdiscoverypersistencespywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2