Extracted

• • Target

    1a5da09e281f4a2acadf791cbad426351a769d2b8057005b1415e74a7ddfb0af.exe

  • Size

    1.2MB

  • MD5

    c29f43cd9249c6c87a0dcdf849c0e2da

  • SHA1

    d113978fd12af6a699ab741e444f028c17c1dc62

  • SHA256

    1a5da09e281f4a2acadf791cbad426351a769d2b8057005b1415e74a7ddfb0af

  • SHA512

    b7ea948e81fe65b425b1c115acfd6d2c49b4a0084e62f62ddce38949dc140f94156535405ba4c263413c6103a530d6a1fd784acca35f52c1d63795ffe0093800

  • SSDEEP

    24576:LtOtoXxa+VQlUxX0YulFoPcIZE+r1ipfms:BOtoxKlU8FoP8

  Score

  8^/10

  discoveryspywarestealerpersistencepyinstaller

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence
  behavioral1behavioral2