Extracted

• • Target

    cred64.dll.exe

  • Size

    1.2MB

  • MD5

    f9f252d2dfbb062e1ccc62df48e3b531

  • SHA1

    a3e0035cef91cf65ca9e447e408895993b371c0c

  • SHA256

    6b5df7909e349ce04b4ec2e3b02bd0f3c1f49173d7d1485946e4c4e9194e88ae

  • SHA512

    39f29169b8859edd5ead59ce5478f3044e127177b238d911f77c0cbab75a216dd2ee10c04c350098f9738815854af3fdce11fa675201364e75df0bf691294973

  • SSDEEP

    24576:/O/VvL5QafhQsnoXyaoMferXQ5rnxQBuLv8Y4fSffUO9l:S5nfhQzOMoA5rnxHv8BSUe

  Score

  8^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral1behavioral2