Extracted

• • Target

    63909a02e9e819e404df25eae886b5aa2270e1d8b6643cd34e8e334e123a4d99

  • Size

    1.2MB

  • MD5

    b05829869d6dc7c44d8dcdebef2ec2ce

  • SHA1

    5de90430a8a7939c48466f35be17b2ad53e8d6fc

  • SHA256

    63909a02e9e819e404df25eae886b5aa2270e1d8b6643cd34e8e334e123a4d99

  • SHA512

    bb9f42a8baf374c70b958999d77dcac10f383317b43094bd8babda51d5562046526cfa788dea47a56eccba3fac5467c9cca56018ed8a234f387516bb6652a1e4

  • SSDEEP

    24576:5O/VvL5QafhQsnoXyaoMferXQ5rnxQBuLv8Y4yWhfUO9l:45nfhQzOMoA5rnxHv8IWOe

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2