Extracted

• • Target
    ba0813de697ce567568e99c75d7af09a8840abc5cd80b9df27cfc26be53327f5
  • Size 467KB
  • SHA256 ba0813de697ce567568e99c75d7af09a8840abc5cd80b9df27cfc26be53327f5
  • MD5 709df85ccc0d63924eae5121841f0775
  • SHA1 a245c979927961598fa28cedb34e6306fcabb7c6
  • SHA512 996ed04521b62316076d51dd73fb479226746d7c61246a68889acce94e0f153abc1e7e0c8e697be1e5282b7c05ba1672343385d6af2b8004fc1c8719e15937bc
  • SSDEEP 6144:zafsiuvAQ+tTm6cyERSiytj71cWE4jKS6vwE:ACvAQ+q6ctRt636WfjOx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  macoutediscoverypersistencespywarestealerworm

  • Macoute

    Macoute is a Windows worm.

    wormmacoute

  • Macoute family

    macoute

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1