keybase | 0c926f5723c4283b151f0b29de5b9e51695b12b3c6437d4909b621118dc37bb0

General

Target
2026-08-03_0d650a6d713f963a9911cfbae7ce7e6c_elex_stop
Size 3.5MB
Sample260804-qb76psfl2s
SHA256 0c926f5723c4283b151f0b29de5b9e51695b12b3c6437d4909b621118dc37bb0
MD5 0d650a6d713f963a9911cfbae7ce7e6c
SHA1 08a339b2fb2bc34ef50b2fae387bc06b720ab225
SHA512 aa6188abe7095d02e9b52908c7bfce6824b056d5244553b8a9cbcd0884da3159a1700c650700bac6388b8fee847302389090dd723e7beadf34ce379ec15161cd
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHta:jbCjPKNqQIFIbBMy+bCjPKNqQIN
TLSH
T1AA06C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_0d650a6d713f963a9911cfbae7ce7e6c_elex_stop
- Size 3.5MB
- SHA256 0c926f5723c4283b151f0b29de5b9e51695b12b3c6437d4909b621118dc37bb0
- MD5 0d650a6d713f963a9911cfbae7ce7e6c
- SHA1 08a339b2fb2bc34ef50b2fae387bc06b720ab225
- SHA512 aa6188abe7095d02e9b52908c7bfce6824b056d5244553b8a9cbcd0884da3159a1700c650700bac6388b8fee847302389090dd723e7beadf34ce379ec15161cd
- SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHta:jbCjPKNqQIFIbBMy+bCjPKNqQIN
- TLSH
  T1AA06C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution keybase persistence spyware stealer
- Detects KeyBase stealer
- Family: KeyBase
  KeyBase is a .NET credential stealer and keylogger first emerging in February 2015.
  stealer keybase
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many email and collaboration clients. Observed in information steale
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2