Extracted

• • Target

    cred.dll

  • Size

    1.0MB

  • MD5

    b87a6d1c962b04a2fed5693a392c2a0e

  • SHA1

    258ea6bb032cd561f29b4a99469f8eeabfecd1c9

  • SHA256

    0b59637e728c7f10767882701f2631a03cbe303f1343fd74e3f8d6f539c8ab08

  • SHA512

    34380b57533709ccef25ca93cc6eb4d519997ba99f269283f935a86f87e8f2b9083d26c6972aace4145f15a6f0ad72a9154dd8bbe753fe32557303d735f0ea01

  • SSDEEP

    24576:PNFxrUgNQWcXbTmjXGW71cwBlTd0DyzzdiM8ldbzHhoqzh:PNFxog2vmLcGMbzJzh

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2