Extracted

• • Target

    1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exe

  • Size

    481KB

  • MD5

    c51a0897fff26f97d73d1004f774c835

  • SHA1

    582754cbbaed0d4663d4865437c388329ca28ead

  • SHA256

    09d220b191634ed6c3b34f516e0cc5ec7ef5cae890d3b3725423b9112ba6846f

  • SHA512

    7a21e350d04eb5f3cec118782655a3aaac32beab9327b99d29a45f4e7ca1f923538ab1924b1d7efb03a63765729634babc2e14f4d96594bcc02db9adf5218300

  • SSDEEP

    12288:3uD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSF+DY:q09AfNIEYsunZvZ19Zis

  Score

  9^/10

  collectioncredential_accessdiscoveryspywarestealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2