Extracted

• • Target

    9ccfdd44ee5fede8d813441081c37054.exe

  • Size

    1.2MB

  • MD5

    9ccfdd44ee5fede8d813441081c37054

  • SHA1

    645baedccb045294e5e00e8632316c8d0e349bdc

  • SHA256

    da4d4bdb72382261383f2b08e86cb670a2ca99acef22c5866187371ec537ba91

  • SHA512

    79f68ee36c42d4d68af62e42cf5c9b7d420c18d7bdca09fb7d40784cf3b95caed41798b47b04e783fdbdff169046ea1bca329ca876a97a663116f385b0271344

  • SSDEEP

    24576:tHjTwpzGkqDZBI6JNwsqG5nDCsGf5Qa9u+aasbWgxU:RjTwpzGLq6JPDCsGh2r

  Score

  8^/10

  discoverypersistencespywarestealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence
  behavioral1