Extracted

• • Target

    deff476e62bb3b38fd2e4cfe36c27e03e1b32ad9a540395f7b14de34acf6597bN.exe

  • Size

    1.0MB

  • MD5

    d63a3769fe739ab7165ac60b424d4c00

  • SHA1

    bc3d6adc338a46efe8dee6e249a18762e6ad60c1

  • SHA256

    deff476e62bb3b38fd2e4cfe36c27e03e1b32ad9a540395f7b14de34acf6597b

  • SHA512

    e0d5beb10825ec7215adb28ec7df04f8447f51a053c030ce80192b04af458910618fe6eba520816dfef8dc3abf4cd3cfa1cbbcbeb561919f792c41ba91eb1014

  • SSDEEP

    24576:IWBhVxYlZdJCTgmP/xEcCJnDOEl5woFNEa1mXu5iPajrVT1qn:IWBhPYrpoCpmX2pjXqn

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2