General
- Target 2026-07-14_28c854b4ff75889a0c93c0a1ad17e064_elex_stop
- Size 3.5MB
- Sample260714-scfh7afs5j
- SHA256 8f7f6ce32f0a296cddcb09185b955b8ced1e145896d3ecf604064e0128e7b81e
Score
10/10
Malware Config
Targets
-
- Target 2026-07-14_28c854b4ff75889a0c93c0a1ad17e064_elex_stop
- Size 3.5MB
- SHA256 8f7f6ce32f0a296cddcb09185b955b8ced1e145896d3ecf604064e0128e7b81e
Score10/10-
Detects KeyBase stealer
-
Family: KeyBase
KeyBase is a .NET credential stealer and keylogger first emerging in February 2015.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many email and collaboration clients. Observed in information steale
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Executes dropped EXE
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1