Extracted

• • Target

    833d78a7e52cbcc21bf4a6843b7ed4130b2d39ae18896370324a7203a705025d.exe

  • Size

    483KB

  • MD5

    148795d6cfcff607f38bd3815a65a7b6

  • SHA1

    a0e7f849720140d61d0bfecffb835fb467ae9faa

  • SHA256

    833d78a7e52cbcc21bf4a6843b7ed4130b2d39ae18896370324a7203a705025d

  • SHA512

    4e97c7ba04c0b61a1dc3dd0801364048527685b0d2df0e65cdb00670a8a73785d9386e92b51668c54ba6608daaf4f9d29749646fea4a751a9a6def74697c474e

  • SSDEEP

    6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccrOT4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZBFT4

  Score

  9^/10

  collectioncredential_accessdefense_evasiondiscoveryprivilege_escalationspywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2