Extracted

• • Target

    cred.dll

  • Size

    1.0MB

  • MD5

    89cb9bdb4c8e64b9bfe35de70d1a1b2e

  • SHA1

    4f69609a7d3f56373a0c0241e9cc4accf9075fc4

  • SHA256

    646ec8d518fbd50186a693b5ea82d1d32c4835b1525393c91e49c6529b48bfcf

  • SHA512

    caf926b756482ba8ea75613d6a51576fb085f0b6844afab2939ddb5b6356f84b6f2721f1982c5d29ae66d2ca5aa4a9ea62b8a8174f185fb94293ab1d97ab4438

  • SSDEEP

    24576:YNFxrUgNQWcPb72kXGWjVcwBlTd8DKT/VSMsCdTzHpgay3h:YNFxogmf2scG1Tzc3h

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2