Extracted

• • Target

    0bfe077dce669d499fd4a6012ac9f972a26762773bcb67752b94c42bec44a857

  • Size

    2.6MB

  • MD5

    db6e7ad1989bed2c0762e3764f7d92c6

  • SHA1

    c22134db04f0eac36bddd0bbad64173603fa2c69

  • SHA256

    0bfe077dce669d499fd4a6012ac9f972a26762773bcb67752b94c42bec44a857

  • SHA512

    b2da98b205bb8abbe81366f134b8ef501968f7b2464717552bbb2ed50b73ee489c4ebb08d8b1afff60226e01afe463797446f197b8eaba2940ad53fdbd455d09

  • SSDEEP

    24576:qbMErVlmEkT+Zn389PbvY/0f/0lqkjc4JhUj0Vl/NvQMvaiDKU:qIExlmsn3819GqkorjYGMvaiDK

  Score

  7^/10

  collectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2