Extracted

• • Target
    _efc9d9a00d755e1db2bece5f3876de42c0933e222d6a97ad47a01827cc153303.txt
  • Size 4.1MB
  • SHA256 efc9d9a00d755e1db2bece5f3876de42c0933e222d6a97ad47a01827cc153303
  • MD5 74ff2f56e582a67bdfffc68502a0b1d7
  • SHA1 cdc1f991db0108259c89164d476cd662143e9661
  • SHA512 6a8e583be3779a88ae733c0bdaf74c6e70fce5547a4e77b033579115b869184ed3932d426521974e4a728a5911effd9e92d1f01de30b8c8e05fdebe4772113cc
  • SSDEEP 49152:R3VriAv9FKve5pu9itHcDRL0IUdVlN+2fuw:x
  • TLSH
    T1811602118AC42FA5CFAC5B1D50FF260EE3E00A8E5456798AE733FD46AFE7644510B1B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionspywarestealerdefense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2