Extracted

• • Target
    IMG_REF009003094_PDF.com
  • Size 1.5MB
  • SHA256 7fad0fe700ddbf3e7f1fdd16634891a823daba17dc8cfc076b3bb282abbc65f2
  • MD5 b7bd855f29bbf2d388e91c0d75eeaa8a
  • SHA1 19f005641e32e0c73b8cc90eda061c855b8495ff
  • SHA512 d6ed916b1e1bcab964bdac83f85427827f5d9bf5ea333495803e97bfdd5c336ff37419ebb274f406ace3b48354dda4442476a951fc7d0d19f705db6425751f5f
  • SSDEEP 24576:VYZHIr3oI6KFoK1ME7QasqmbtcUNhp+ZkTLIE5SguCXrGO5oGK+LQ9whTJfNeli/:VY+r4ANib7hId5gTrGO54+sEdfMYu
  • TLSH
    T13675121995A7C901E0B94F724DF1B1B02332AD56E626D22F2FC50EFB7663301BD81B5A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionspywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2