Extracted

• • Target
    63a4f55282106baed0ef20a3017768fd1fca367d63bf12206768e18211b985a0.exe
  • Size 1.2MB
  • SHA256 63a4f55282106baed0ef20a3017768fd1fca367d63bf12206768e18211b985a0
  • MD5 4951465b8b9db30de15a8034b4e62137
  • SHA1 6f431cfe9413d3b900b3c0f69d8fee0dab1b7a19
  • SHA512 5e3b460deb240db96dcff4fccf6da2576eeddefd5b831fa8d05caf16c1b77b0858a9403e239730903b23b66882e95b4d62dbbe083d2d4e70a486ec23d8dfde73
  • SSDEEP 24576:CxZBaRGGbT5BJe/V6h2K/ZIb6BZynfN0EbgF:CxZBaRGGbT5Pe/Vo2cIb6BZGfN0Ebg
  • TLSH
    T11D452B07E39286F5C5AAC170C75AD332AA70F44A9435B61E2EADDF023E16F609B1F714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  command_and_controldiscoveryexecutionspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2