Extracted

• • Target
    f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5
  • Size 500KB
  • SHA256 f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5
  • MD5 863e84aa329d8cbd65aa4adebdac6ac6
  • SHA1 dade4c2ebf3423ca4ba6f9df12dcacb0c78be512
  • SHA512 521284295a13af0996ff0ea2ca92099a82b817048291c09b0a7577de762da0f740506426d8b9349e83f966dd85d3d7cb36df6e56c377e76273686edb3a273224
  • SSDEEP 12288:2jYKkJj6GmZUm/u2Wo9O7GMGjonPyYySK:YYb6nZjuBowCMGUnPNySK
  • TLSH
    T1AFB44D53AB50A02DF1A389B0F9B4A2575C2A7D350A58EC1BB3405F5935725E3ACF072F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoveryexecutionspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2