Extracted

• • Target
    41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe
  • Size 223KB
  • SHA256 41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629
  • MD5 c27f23181c3ebd80f3dae27d88b86267
  • SHA1 12bef40a06323256fc0e903503a49f4623af7dcb
  • SHA512 b22159a971988198fee78f861ad938dfce12ba5b993593b7bfd4e54938b95d39b6f3d09ed4a9be7081181a8499a7aeac3a47a2edfab52812e7757c6d53d753ce
  • SSDEEP 3072:8Cut7gBHz/0OUGyQkRACh3Uim7ef10wYaGyeG7sGcMBIGv:3udgBHz/pUNlRAC+bu1iaGy3Jv
  • TLSH
    T10124F801F11FDBEAD69303BC4957A602BDBB36912B208EE783844A705D0B1D57AEDF91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Renames multiple (9048) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2