Extracted

• • Target
    VPN_Unlocker.bat
  • Size 1KB
  • SHA256 3735e576b833f02b50fb76cee8b378e603d91a3a87e78575c62ab53e784e6182
  • MD5 2453cd05b4c233373ecd18dbeabf9a57
  • SHA1 2b81aa36efff4beb486110566d10caf5a2364f8c
  • SHA512 178a0ea75cb872030f16a784fdee3a48e070231a130a6cf2bc616c1a9b294523147f8fe993a7d851672fc478b856b5a55b8458d0c04ffebe218fd4da2777777b
  • TLSH
    T10D31979B3520F2A487AF07850C3C266DFC026CEB4E075D86743E6079666A3D0B2FD586
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionsalatstealerspywarestealerupx

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1