Overview
overview
9Static
static
9Decache Ex...7z.dll
windows10-2004-x64
3Decache Ex...7z.dll
windows11-21h2-x64
3Decache Ex...7z.exe
windows10-2004-x64
3Decache Ex...7z.exe
windows11-21h2-x64
3Decache Ex...7z.exe
windows10-2004-x64
1Decache Ex...7z.exe
windows11-21h2-x64
1Decache Ex...ux.sfx
ubuntu-18.04-amd64
3Decache Ex...on.exe
windows10-2004-x64
1Decache Ex...on.exe
windows11-21h2-x64
1Decache Ex...32.dll
windows10-2004-x64
3Decache Ex...32.dll
windows11-21h2-x64
3Decache Ex...on.dll
windows10-2004-x64
3Decache Ex...on.dll
windows11-21h2-x64
3Decache Ex...ec.dll
windows10-2004-x64
3Decache Ex...ec.dll
windows11-21h2-x64
3Decache Ex...nc.dll
windows10-2004-x64
3Decache Ex...nc.dll
windows11-21h2-x64
3Decache Ex...ts.bat
windows10-2004-x64
1Decache Ex...ts.bat
windows11-21h2-x64
1Decache Ex...ze.bat
windows10-2004-x64
1Decache Ex...ze.bat
windows11-21h2-x64
1Decache Ex...rl.exe
windows10-2004-x64
1Decache Ex...rl.exe
windows11-21h2-x64
1Decache Ex...dd.exe
windows10-2004-x64
3Decache Ex...dd.exe
windows11-21h2-x64
3Decache Ex...eg.exe
windows10-2004-x64
3Decache Ex...eg.exe
windows11-21h2-x64
3Decache Ex...ew.exe
windows10-2004-x64
7Decache Ex...ew.exe
windows11-21h2-x64
7Decache Ex...ew.exe
windows10-2004-x64
9Decache Ex...ew.exe
windows11-21h2-x64
9Decache Ex...ew.exe
windows10-2004-x64
9Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/06/2026, 03:58
Behavioral task
behavioral1
Sample
Decache Exporter/bin/7z/7z.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Decache Exporter/bin/7z/7z.dll
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
Decache Exporter/bin/7z/7z.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Decache Exporter/bin/7z/7z.exe
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
Decache Exporter/bin/7z/7z.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Decache Exporter/bin/7z/7z.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
Decache Exporter/bin/7z/7zCon.linux.sfx
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral8
Sample
Decache Exporter/bin/7z/7zCon.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral9
Sample
Decache Exporter/bin/7z/7zCon.exe
Resource
win11-20260513-en
Behavioral task
behavioral10
Sample
Decache Exporter/bin/7z/Codecs/Modern7z.32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral11
Sample
Decache Exporter/bin/7z/Codecs/Modern7z.32.dll
Resource
win11-20260513-en
Behavioral task
behavioral12
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlicommon.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral13
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlicommon.dll
Resource
win11-20260513-en
Behavioral task
behavioral14
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlidec.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral15
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlidec.dll
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlienc.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral17
Sample
Decache Exporter/bin/7z/Codecs/brotli/libbrotlienc.dll
Resource
win11-20260513-en
Behavioral task
behavioral18
Sample
Decache Exporter/bin/check_dir_exists.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral19
Sample
Decache Exporter/bin/check_dir_exists.bat
Resource
win11-20260513-en
Behavioral task
behavioral20
Sample
Decache Exporter/bin/check_size.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral21
Sample
Decache Exporter/bin/check_size.bat
Resource
win11-20260513-en
Behavioral task
behavioral22
Sample
Decache Exporter/bin/curl.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral23
Sample
Decache Exporter/bin/curl.exe
Resource
win11-20260513-en
Behavioral task
behavioral24
Sample
Decache Exporter/bin/dd.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
Decache Exporter/bin/dd.exe
Resource
win11-20260513-en
Behavioral task
behavioral26
Sample
Decache Exporter/bin/ffmpeg.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral27
Sample
Decache Exporter/bin/ffmpeg.exe
Resource
win11-20260513-en
Behavioral task
behavioral28
Sample
Decache Exporter/bin/history/BrowsingHistoryView.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral29
Sample
Decache Exporter/bin/history/BrowsingHistoryView.exe
Resource
win11-20260513-en
Behavioral task
behavioral30
Sample
Decache Exporter/bin/history/ChromeHistoryView.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral31
Sample
Decache Exporter/bin/history/ChromeHistoryView.exe
Resource
win11-20260513-en
General
- Target Decache Exporter/bin/history/BrowsingHistoryView.exe
- Size 646KB
- Sample260602-ejmn7adv4v
- SHA256 a14055e8b09fd980e82a3eb551fe7ca60018b5486d46e462fda29ee88f252ca0
- MD5 0f5aba101aa4d94be74690aa60bf7840
- SHA1 40557e751e76b1f9608c2d0c12ce0cccd2588e11
- SHA512 a987c36c3b5ab8b5e65a5af8542c3cd9ec67187aab899211809c86aab93dea962e4a4ffb8107de60d0e9c6661c275a9b2f563165c2a7ac92b68901ddfab68789
- SSDEEP 12288:RxNu2A3uJepO0u9VMpw5i/9U2gI4Ka0N3E3blMq3ZWb54D8XYEcGFPH2EEYiBB2i:TYZ30epws6Civ50u3bX8b54D8XYEcyzo
- TLSH T16EE49D83FBE380F1E8A614B915FE567B1D35AA054336D6D7ABC42C408DA12F1693E387
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BrowsingHistoryView.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 576 BrowsingHistoryView.exe 576 BrowsingHistoryView.exe 576 BrowsingHistoryView.exe 576 BrowsingHistoryView.exe 576 BrowsingHistoryView.exe 576 BrowsingHistoryView.exe 576 BrowsingHistoryView.exe 576 BrowsingHistoryView.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 576 BrowsingHistoryView.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Decache Exporter\bin\history\BrowsingHistoryView.exe"C:\Users\Admin\AppData\Local\Temp\Decache Exporter\bin\history\BrowsingHistoryView.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:576