Extracted

• • Target
    QUANTUMBOOST.exe
  • Size 3.0MB
  • SHA256 4ad3818ea21f244e973b12b61148e042dadc75161fdb3d01f63a16491f7854c8
  • MD5 a66d2304a9d9e41b3d598e0a4154a5c9
  • SHA1 1188db95ec1694125226a1bc47b49598394cc867
  • SHA512 1f90a47c6d408dce34b7dfb87bad98ae22ac32db77f17e17a62aa25606bc85a27eb34b87dc24a8b5b8473581870801d0ee3b40f25fca72635fbc355338d7c1ba
  • SSDEEP 49152:p0QBddMAnREWTta9pmU9mC6QIU7ZRgGUClB9pna47YdWKTSZglwDjSUILSPOhF3h:pfyWApV6QIcDwSjHPOn3RNm4R
  • TLSH
    T132E57E47E19360ECC46BC170974BA232FA75B8494434BDBB95A4CB313F72E506B6DB28
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverysanta_stealerspywarestealer

  • Family: SantaStealer

    SantaStealer is an information stealer written in C.

    stealersanta_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2