General
- Target 2026-08-03_cf8c0ba5881a2796817e49129a905672_elex_stop
- Size 3.5MB
- Sample260803-m4jr2avfmd
- SHA256 59e79ed9ed00e749d521ad8546f4f7eecd06d6ebe797a73856e99b0b845f6725
Score
10/10
Malware Config
Targets
-
- Target 2026-08-03_cf8c0ba5881a2796817e49129a905672_elex_stop
- Size 3.5MB
- SHA256 59e79ed9ed00e749d521ad8546f4f7eecd06d6ebe797a73856e99b0b845f6725
Score10/10-
Detects KeyBase stealer
-
Family: KeyBase
KeyBase is a .NET credential stealer and keylogger first emerging in February 2015.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables referencing many email and collaboration clients. Observed in information steale
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Executes dropped EXE
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1