Extracted

• • Target
    34630e3823e14ba3109e67fc4a34117d87d89add6311572ae3a2aa77153410d5.exe
  • Size 1.2MB
  • SHA256 34630e3823e14ba3109e67fc4a34117d87d89add6311572ae3a2aa77153410d5
  • MD5 1d2785893106aaef244281e018b205b2
  • SHA1 83a766c5e4b38ca2aa8367495e44e309abc76b16
  • SHA512 a0304fae5e21aec6d0b72bd1b137ef7698d46eaecfbc94510bb6b78bf327fcf0477c837b5b68386a4b1f95e6889729ac88b03b6620e43cd93f7d36d2f23064fc
  • SSDEEP 24576:SNA3R5drXPYhkYY2czotBRMoZ2gp8trRbP6dwc8qsOp/GDXOG5vwldq:r5QOmF2gpmrdP6qcIOcDXOBlw
  • TLSH
    T173450103F5CD87BDD66209713934A7315978BF631D34C96AB3C0EE2C9A7009DA624BE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryspywarestealerpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2