Extracted

• • Target
    8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78
  • Size 4.8MB
  • SHA256 8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78
  • MD5 7f63e33605db456d23ef7fa478f163b9
  • SHA1 59fcece018e9ec61780e9c39f5c4160e6c98e679
  • SHA512 f01770d4df1b4cd44cdd28c7a8fc509f7e9fe11f47f235cec68bba504a04523ca93debf72a8633adeb7d12d248f18363ccac758bd0039cd51339aae0fe4aeb4b
  • SSDEEP 98304:J2YgpA79tqLqWox4dmbDaapjar2hKYADYAZSsz5wPISRMS5kB9AH:t4dmbjpjar2hVb65NC2i
  • TLSH
    T15536E047E2A320ECC56BC174476B6772F931B8591134BE7FA594CB302F22E506B2EB25
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionchromelevatorsanta_stealerhacktoolspywarestealer

  • Detects ChromElevator

  • Detects SantaStealer

  • Family: ChromElevator

    ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

    hacktoolchromelevator

  • Family: SantaStealer

    SantaStealer is an information stealer written in C.

    stealersanta_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2