Extracted

• • Target
    download (23)
  • Size 4KB
  • SHA256 59d7841404a79d5001e40b0fe79a7f90b907ccbfea38f220278a3e61ea2578f9
  • MD5 00c5b29252603ee6c810a1d69ffca491
  • SHA1 a3367c3b45ae41211c90f293e11c7f9dd27ae23f
  • SHA512 31adf51b45d516f291a14aab6d65efe256ecf5de378fb54f41a388f02b35fad9851bc1f1b3d979944b6085606942d9a64bee825cd2c19fdc068db4c8e4eb9ab7
  • SSDEEP 96:eqTWyi/X8jS2nIjvQ6qfqap77H5aAxIaussBtUjbTKdkEYoR2rkxlXap308WUg8U:/TWXZ2+/q5HZaAxk+jbTKdhlRMkxNIk1
  • TLSH
    T1B9A1866BBD0BF7708F4252A8644D513C6CA04EB749A18C79744C847C0FAD7B5E362ADE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverydropperexecutionpersistencespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2