General
- Target edited_ransom.exe
- Size 12.8MB
- Sample240728-drxnpaybpg
- SHA256 4373afaa735149fa377994bf045b5ea884dacc3b709de121269abc087c10187d
Score
9/10
Malware Config
Targets
-
- Target edited_ransom.exe
- Size 12.8MB
- SHA256 4373afaa735149fa377994bf045b5ea884dacc3b709de121269abc087c10187d
Score9/10Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
Renames multiple (3287) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.