Extracted

• • Target

    4fb4496aead93bba8589248a89030c9ba1fb033aa505d8a14295b7ae511e2486

  • Size

    1.2MB

  • MD5

    c7612ef960097ff466e641c7fe0cd5d3

  • SHA1

    06849181c7ed4a8b44440f66583e6d1c11308916

  • SHA256

    4fb4496aead93bba8589248a89030c9ba1fb033aa505d8a14295b7ae511e2486

  • SHA512

    f812f7d07b5977e09b56c1ed5deff4c7be4546627100a66bbebe1163a9d54634375686bcb0265b8c14384719e356202bc922119883bcc2f97b03c07714f7ba25

  • SSDEEP

    24576:axYTyT6AMgQZvBHa726ZwccIIF1cV6n6zyYqOFzd6:fAMgQ7672swJIR06wb

  Score

  9^/10

  credential_accessdiscoverypersistenceprivilege_escalationspywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2