Extracted

• • Target

    5254ce538294932692af5ae3ecb6520be250faeb6808eebd5ec4262f5fd6ad23

  • Size

    552KB

  • MD5

    928436754c8043a6885e2480e1b5da60

  • SHA1

    d3d44ff9802bb3c26a2dd53a363608853bb2d2b7

  • SHA256

    5254ce538294932692af5ae3ecb6520be250faeb6808eebd5ec4262f5fd6ad23

  • SHA512

    80e6d809eef0701e3c25906e5d658e50659c73dedc90790889c4e8bf4a82a9b81f857b3e57212368c19a5a7a434ef26c4a8c2e943173573d40d9437d356c40e0

  Score

  9^/10

  collectionpersistence

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Sets file execution options in registry

    persistence

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2