Extracted

• • Target

    cred.dll

  • Size

    1.0MB

  • MD5

    2b999ca7b09926583ba69257303e073a

  • SHA1

    4533c1084c516fe80b85b59bcad441827573548a

  • SHA256

    242e00c2c3bfb41930b292448f79ac53cbec0f7315d4f71c23326a8ed5a51368

  • SHA512

    36fb0549181d75370893822e351107265763256a454cbdf37985bfbfb03401b3929cb2a15d931d89adac67206358e7a6f53dea6047665bb4198ba3092e656464

  • SSDEEP

    24576:keBhVxYlZdpaTomP/xscCJnDOjl5wQO5Mqt29hpiPijzdTd3u:keBhPY75ACX29vhjf3u

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2