Extracted

• • Target
    ecee4c71ba9a6febcd573b122f9ec05eb94fb8a9aa6ac97b8c4945ebc3448f07
  • Size 482KB
  • SHA256 ecee4c71ba9a6febcd573b122f9ec05eb94fb8a9aa6ac97b8c4945ebc3448f07
  • MD5 78e2f778cfffce2927ff5f79feec67b1
  • SHA1 c933f45d72bc4c881256259aaf53748d44fb6cbb
  • SHA512 605ee7fe8a12b598c6dfebbf1b8cd358ca4a79574e8a06b5006ff69f1fbcaa9ccaa98c107c7d1547ddd7d5d24e9c7220f7fd009d3f0f47ca94dcab3c6d17d1b4
  • SSDEEP 6144:zPxdVAQTeXtqd2tl3emdxnc1BEK146Yg2Re+gUrL6L7m0dPu+1kEpKLPDI40o:zP3avEmda9YgUrL7uG5R7R
  • TLSH
    T134A46B18B3E80569F2BF8A3C88730505D7B2B8125761E7DF1B9455DA2F337D09A39B22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accesssentinel_stealerspywarestealer

  • Detects Sentinel Stealer

  • Family: SentinelStealer

    SentinelStealer is an information stealer written in C#.

    stealersentinel_stealer

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2