Extracted

• • Target
    8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818
  • Size 583KB
  • SHA256 8551bd2509d97df3878ce1ed39eb31dca07b57efc17d7e71810822f547e73818
  • MD5 aa93ba8b0288c65362442cb7c81aeee7
  • SHA1 ea15115bbf542e178b3c01f3184f8c4833ee1744
  • SHA512 17910c9d1c361201b2cd3b445321e00f28d842b4b061fad4bab9c22ce8cda5ef8b0f91227eb24f192fe4418abacb59ec5466126d516d645e080e2797972d592a
  • SSDEEP 12288:gKEXyvVUsQ5Pu8c1j3a5r9d2m5lVB0OwzbudFa+mJUGuowp8y48Jp0w9:gKEXy9UsgPu8c1jarb2m5Z0Owzc1Y8rJ
  • TLSH
    T1EFD46C4AEAD381F0C983597631BFB22F6B71AE178935CACBDBE51D85E923740510F241
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypersistencespywarestealer

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2