General
- Target edited_ransom.exe
- Size 12.8MB
- Sample240728-drxnpaybpg
- SHA256 4373afaa735149fa377994bf045b5ea884dacc3b709de121269abc087c10187d
Score
9/10
Malware Config
Targets
-
- Target edited_ransom.exe
- Size 12.8MB
- SHA256 4373afaa735149fa377994bf045b5ea884dacc3b709de121269abc087c10187d
Score9/10-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Renames multiple (3287) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.