6a2f8ebf65d54a4d9c8b720d01da77ad796683f1a5b8bd3d08738d7df4365f8a

General

Target
2026-05-29_0ca2b7f960149485fea0ec0b0194ee3a_conti
Size 348KB
Sample260529-hg2bcaev9x
SHA256 6a2f8ebf65d54a4d9c8b720d01da77ad796683f1a5b8bd3d08738d7df4365f8a
MD5 0ca2b7f960149485fea0ec0b0194ee3a
SHA1 414b6429b9dd5dc0bcf4c70d053e62d47c75d191
SHA512 65638b779ce3967bd8f2b8f8ae51f23937aabf4ec06651310cb581e1b9fd5de10ce66e4989a9e0139a050a721d5fb8dcc660b4a4c40c09ab88d8fc0405c86517
SSDEEP 6144:WVtdb+jzqDr45vALThdJc3YMer19+VPIKTYOUIHwyQaRXStOl2/lHkYxMarl3F1p:WrduqDIAKTu1uPIKTLrH7dStnkW5l3F7
TLSH
T11D741266FDCE45CCDB55A5F681FB8329A234782CC434B8252183D02DE9C9D16F45AF8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-05-29_0ca2b7f960149485fea0ec0b0194ee3a_conti
- Size 348KB
- SHA256 6a2f8ebf65d54a4d9c8b720d01da77ad796683f1a5b8bd3d08738d7df4365f8a
- MD5 0ca2b7f960149485fea0ec0b0194ee3a
- SHA1 414b6429b9dd5dc0bcf4c70d053e62d47c75d191
- SHA512 65638b779ce3967bd8f2b8f8ae51f23937aabf4ec06651310cb581e1b9fd5de10ce66e4989a9e0139a050a721d5fb8dcc660b4a4c40c09ab88d8fc0405c86517
- SSDEEP 6144:WVtdb+jzqDr45vALThdJc3YMer19+VPIKTYOUIHwyQaRXStOl2/lHkYxMarl3F1p:WrduqDIAKTu1uPIKTLrH7dStnkW5l3F7
- TLSH
  T11D741266FDCE45CCDB55A5F681FB8329A234782CC434B8252183D02DE9C9D16F45AF8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access discovery spyware stealer
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables referencing many Password Manager software clients. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2