Extracted

• • Target

    download.exe

  • Size

    469KB

  • MD5

    caf2fd8e96fdffe86728ac3d3baca925

  • SHA1

    9c3d2eeb44669581c5d44bcd52e65390b8afcfa4

  • SHA256

    fadb49f75ed91c5de958fc26e52284a556a290cace533dbfad3c41089f7c8453

  • SHA512

    eb7fdbbedc49285e4705e6e35956dec8b741435a6648f99df762fc8a8f74c3478d3643ed47ef44d2c104cff5da6a0296634cfcea648bd69aed76feaa1c03d810

  • SSDEEP

    12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSLn9:uiLJbpI7I2WhQqZ7L9

  Score

  9^/10

  collectioncredential_accessdiscoveryspywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2