Extracted

• • Target

    Win32.KeyPass.zip

  • Size

    1.3MB

  • MD5

    f831ffa7faa4da66482aa252536e1b0f

  • SHA1

    aa305bd6962ebf06e26462d25140691585f85341

  • SHA256

    8f8f3834abab12ebd792487a89e45bdb8c8f41b51f232dfb3edb8e8140c9ff8f

  • SHA512

    3bf39aeb6c52de76aa864fb7d810cb4adbd2c7e0a2b91e8b6865967843044d628ca66a4531c720e5cd75dfb82a371e467f823819c0d9d559bd371efeec1d962a

  • SSDEEP

    24576:k5yq9y9qttzFVPyDcYwohuvh0GsGkjHkevwLfK4uiIP/nMPbcdKK:cH3FVP8hphuF2Hk1LfK4InMLK

  Score

  8^/10

  discoverymotwphishing

  • Downloads MZ/PE file

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Probable phishing domain

  behavioral1behavioral2behavioral3

• • Target

    Win32.KeyPass.bin

  • Size

    2.8MB

  • MD5

    6999c944d1c98b2739d015448c99a291

  • SHA1

    d9beb50b51c30c02326ea761b5f1ab158c73b12c

  • SHA256

    35b067642173874bd2766da0d108401b4cf45d6e2a8b3971d95bf474be4f6282

  • SHA512

    ab883364a8907636c00a4d263670cd495d0e6c521283d40c68d47398163c6ee6647cfbbc2142005121735d9edf0b414ddac6ea468f30db87018c831eaa327276

  • SSDEEP

    49152:0u1ImfQE5L1PtWHeHoQAOs1dKvHHg/o2S1pj798JGKCO8C/eZRwCr:dzV5JPtWHeHoIs1dGHHx2S1998JGKCOC

  Score

  10^/10

  credential_accessdiscoverypersistenceransomwarespywarestealer

  • Renames multiple (12284) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral4behavioral5behavioral6