Extracted

• • Target
    PO#240145.exe
  • Size 807KB
  • SHA256 8338252e1b1b007bfb5317df49e88c9aeb3b7f8206465c2e84f9d2d949e7cf95
  • MD5 9319deb64b02bf5d0be2cfdad327e523
  • SHA1 b7a609a90db8b1c2b73c2db9765e2e1d8e92031b
  • SHA512 b50e84e06e785d18f18e1043333c8e129cd9537e476199e0424a044e96dec121d03a9fc4ec2785a0c3f8df7150356279a65e6d2609acdee5420219c8b61d0219
  • SSDEEP 24576:7VYh4oh3ztDOhoE3FuS5K5+F4aVJerIjKyTitzSWpdooQck0M3Qb:7qnZ0hf3iEnwkO0ite+moQck0M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionspywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2