Extracted

• • Target
    sub_abce9c19df38.bin
  • Size 199KB
  • SHA256 abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af
  • MD5 0d20e90382f881116201ac7c9298aab6
  • SHA1 217d943f86ab19cfcab9b34db84807a663e1e3fe
  • SHA512 c99d4f7afdc6b200c41976b30eaf50a78555f6feb0127c79f368b397301f9c98b25da11389da198e540516bc10dec942709848c6ec936a56cb1d4617af820ce5
  • SSDEEP 3072:2yui35przV2uZ7PHd2AKrIeHIlI/E73BXu3Wpiv:KinrRTVKrPiI
  • TLSH
    T17A14E51037FD9609F2FF2F75B8B4846447B1F8A37921D65D0984A4DE2A22F84D920BB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botdiscoveryagnianecinoshispywarestealer

  • Detect Cinoshi payload

  • Family: Agniane

    Agniane is an infostealer written in C#.

    stealeragniane

  • Family: Cinoshi

    Cinoshi stealer is part of Cinoshi project Malware-as-a-Service (MaaS) written in C#.

    botstealercinoshi

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2