Extracted

• • Target

    1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.bin

  • Size

    93KB

  • MD5

    68958ce8e51a4b8dd6ff8b8a57515be2

  • SHA1

    d88289eab220b4d8e3dbe4f9f2ce3539105d3c4a

  • SHA256

    1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f

  • SHA512

    a3b858721fb2060bf413edf4a893a8d6e860857225bad60d7c3a5be57f672f63d71582d30ace1ed881c57ef6d47a2f196c2b2c135cb4ce86d4015332585484b4

  Score

  10^/10

  spywarestealerpersistence

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Sets service image path in registry

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2