Extracted

• • Target
    26c3abc8bf32ff0f548adfa3c5fdf430c9bf061865512b83c4559553e668766c
  • Size 5.9MB
  • SHA256 26c3abc8bf32ff0f548adfa3c5fdf430c9bf061865512b83c4559553e668766c
  • MD5 0310535f3088303ad44e49aaab1b7fd8
  • SHA1 12fbfcceb42079e9d9d302a671c7f05f5b48ce96
  • SHA512 952ba8883f1c7d88509ac397b561f4191d24f35d68f82950a2ab41623bbc675373019456c69622b8b6a3d2ef6f941cff83ebc02b81b8249144c2d2ecef38f0ec
  • SSDEEP 98304:+0eWMZM+pGr6kvfCoa6JHBn9zSajjJztzAANy29XOQz7D1P8rvc2K:LqoaS9zScjJztzXNvlD1
  • TLSH
    T1E956AF03E1A358ECC9ABD674425B6772F930BC2945387D7F6A98C7302F61E50672EB24
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverychromelevatorsanta_stealerhacktoolspywarestealer

  • Detects ChromElevator

  • Detects SantaStealer

  • Family: ChromElevator

    ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

    hacktoolchromelevator

  • Family: SantaStealer

    SantaStealer is an information stealer written in C.

    stealersanta_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2