Extracted

• • Target

    e0fa46dcdfa93a3769a567a1498742d7.exe

  • Size

    1.2MB

  • MD5

    e0fa46dcdfa93a3769a567a1498742d7

  • SHA1

    ee175a77cd109dd569630f70191a3f99205f6b51

  • SHA256

    4078918043613a0ca03b117d29263f67a09477e6bab9d624453051d702065eb4

  • SHA512

    9596c6d645839e3cf5f8edadbcfcb8102e40de6acd3f77d0e72eb15bcd727444a601a7e31eb17bc2bf61a8b35d29666bc58e2083258bb136c105aa2867b20e97

  • SSDEEP

    24576:Bjd+7fzBMqZjh2sntUcCy8LfunZzW8IFHcDVh1HhHAO:BABHjh2OZ80ZzHIF85D

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2