General
- Target 2026-07-09_09ba1464ae55af833b8c0b0216fa6f26_elex_stop
- Size 3.5MB
- Sample260709-m54htshs6m
- SHA256 1b968ee61acdc56d0999713235d0c245dc93cb208cae2fcc2ccc8a7343ef569a
Malware Config
Targets
-
- Target 2026-07-09_09ba1464ae55af833b8c0b0216fa6f26_elex_stop
- Size 3.5MB
- SHA256 1b968ee61acdc56d0999713235d0c245dc93cb208cae2fcc2ccc8a7343ef569a
Score10/10-
Detects KeyBase stealer
-
Family: KeyBase
KeyBase is a .NET credential stealer and keylogger first emerging in February 2015.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Detects executables referencing many email and collaboration clients. Observed in information steale
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1