Extracted

• • Target
    ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe
  • Size 1.3MB
  • SHA256 ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce
  • MD5 ad6ba483e421976fe0145941be20dab9
  • SHA1 ca6bca5be190052a08b834e7a473ad43a03d231b
  • SHA512 44c7a940eb1078ad4ad2cf529363e10a69ca3815f0a70ffbd11211a9f2cc42a7029b8a8f53ba0bef79864178fa4a2d6aa4780d8931436469cfe694c4ad89f739
  • SSDEEP 24576:krG7El628EMf/SlAvy4kcl1jg1dco+IqvwasnSJnSzOBo9lIB5y6ymqZw:gGglaEnl0O1CoHqIaJJnaIo9lIn8mX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionpersistenceransomwarespywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2