Analysis
- user interaction
yes - max time kernel
898s - max time network
900s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/05/2026, 06:02
Static task
static1
1 signatures
General
- Target taker.exe
- Size 17.8MB
- Sample260509-grpvmabt7y
- SHA256 325841dc3748c233d4a67864266047798904b94c666a554c0b3564bfad49facf
- MD5 3e232faaf9cab8800f3a6021d9fc0c6f
- SHA1 327c26933580ebf49777d330c00e75e641cb6a3c
- SHA512 229292d88140b22c4d6965174ec0494bac0f6269f0da433a3f0a47b39efb1ed3079ecc42a933f2926ed936bfe23ee4c1cb2a64d4d15efd8c1cf6e82484ad5969
- SSDEEP 196608:W3+skfptZpLllQM9HeCNCPVO+eehC1tSSyV:HsknZpJfLvS3V
- TLSH T17B175A12639B4DF5DCC637B4B98B133D8724FD309E290B6F9A8895201C536DCAD1EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 2 discord.com 10 discord.com