Extracted

• • Target

    PWS.MSIL.Stealgen.GA.MTB02559f0afdb12d5a44162d8c4aadfb89cf07c922cf19294c23590bc383ae1a94N

  • Size

    237KB

  • MD5

    95e3799df95c333eb5904813f864bda0

  • SHA1

    fe55c816b4e80f0765d9363181900cffab99d187

  • SHA256

    02559f0afdb12d5a44162d8c4aadfb89cf07c922cf19294c23590bc383ae1a94

  • SHA512

    841bb7f0156cfc055f7ea0f141e65ede00c1e917aeab719cb86b557f5145859e1e702d4b673b44aebf1a35c8c2af06f2d7fab1ff97d45f2b87c61fe13d87a5b1

  • SSDEEP

    3072:/J6IY+0lD4awMe9CHmmnWKe9iZd7UI2Lle4RbaE6cvFKJL+heI/Kh73WmqcSCJLD:BTY+0lNwOnyIv7UI242bL/kAlxO

  Score

  10^/10

  blackguardcredential_accessdiscoveryspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2