Extracted

• • Target

    a1217d96dc600be3603164c3c1eedb6050e887096ed50f33701f1f2eae9b9eae

  • Size

    521KB

  • MD5

    78c74d9e2c1608747abe379cc4a28776

  • SHA1

    1139b21d4e43cd5fb9206728ce79b06c2e907332

  • SHA256

    a1217d96dc600be3603164c3c1eedb6050e887096ed50f33701f1f2eae9b9eae

  • SHA512

    2dd2c9f831d657f31eb366ad90eaf7e5b00d721ccc6e36e95824333bf8a366c43772c8b575d8cc85ed12ec175af35e72edca07e978e30f4d2737e4e1ba293c78

  • SSDEEP

    6144:1XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cNA5Gv:1X7tPMK8ctGe4Dzl4h2QnuPs/ZoNcv

  Score

  9^/10

  collectioncredential_accessdiscoveryspywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2