Extracted

• • Target

    7b153edb20d7b9ad2a7580e0a540861478651ea243110417a6a317457069a50e

  • Size

    215KB

  • MD5

    ee8ef9cda5a27c085be8bcf2b27fed9a

  • SHA1

    e86edec732f293fd382e59eefb7167f3c22b4fb3

  • SHA256

    7b153edb20d7b9ad2a7580e0a540861478651ea243110417a6a317457069a50e

  • SHA512

    c610d4bb47fb4a4a15435577e891073cd03a32cd27ba9dee78dae5a605920be1d065dbbaf3025246a3356e3bf3f5279d1b00b0c3e87fe359f689e57c0638432d

  • SSDEEP

    6144:yTwpT4oAwoYgR8U+BTBV/Sqn8s6TEZLU:yTwp1hBVK5s6Ts

  Score

  8^/10

  discoverycollectioncredential_accessspywarestealer

  • Drops file in Drivers directory

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2