Extracted

Extracted

• • Target

    af0b876a436452a6e998fc622493aaa4553bcc53864d66a6a6d5d476a85902eb_dump1.exe

  • Size

    483KB

  • MD5

    87b596dacf0d6b3d57e6213d974ba376

  • SHA1

    71b89be1b7777072f51503d122449190b948df97

  • SHA256

    df6e2c62cf6413a030efeb9ae5e6288d77c4416332fbf05f461c83fa079dda49

  • SHA512

    5304f3de8bc18f937364cf11b894f12578ff2584d7f73c72fcb1764a922c215381030f07aef05e758e4a28fe8b6d72740abbc6e8419ed993d9355ad231e0460a

  • SSDEEP

    6144:PXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZ5AXIcNS5Gv:PX7tPMK8ctGe4Dzl4h2QnuPs/Z57cv

  Score

  10^/10

  nanocorecollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2