Extracted

• • Target
    cred64.dll
  • Size 1.2MB
  • SHA256 6b5bd7f56416955111cb628f19133dcbaeddd2e3d4c063bb709466cd5eeefd95
  • MD5 ede78ad472b065ed371e08eba8d8f809
  • SHA1 9f3f14bfc5b64e8891a72a1bc097bfae4fafbc34
  • SHA512 33e962571c51df9cfa6fcbccdc43b688f0b0e06d3a1f0804dc5bddbb2ab4f28ed4f5e0fc1816ef70d752d4f6f45ec0bfe099eaa12b4b5d00735b0a110ea2e5ba
  • SSDEEP 24576:orR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRw/OnW:okHmiyCkhh2Bamituw+UGt
  • TLSH
    T108557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2