Extracted

• • Target
    Prime Link Global Ventures PO/Prime Link Global Ventures PO.js
  • Size 4.1MB
  • SHA256 be2232269aaf00e1f953503d5188a4eedc1decc51c71feeb1b9e63683fb63925
  • MD5 dc9cc2af6d17ef0084393d536712c940
  • SHA1 ee838d4ecd0f4b767bd8cb6494a65f1e7bf14583
  • SHA512 474b7753b3dc25c6c063b704035bcb775b35ac8e2bc232b0483f2938102b35230ea0a24a0db364326af7ee8dc44106661dca48543b584da755577799f4836d08
  • SSDEEP 49152:MK7U+q68ga2Bgm1xDp+a0FvPLfnt7WQwBZamnZ:X
  • TLSH
    T16916F21149C42FB9CF9C5A1D50FE161EE3E04E8A9126B98AFB33FD06EFE7604511B198
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionpersistencespywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2