Extracted

• • Target
    2d4cc19674d45b952f786aa4bbc538c37a986bdb0348acafdaac68535d026dff
  • Size 5.9MB
  • SHA256 2d4cc19674d45b952f786aa4bbc538c37a986bdb0348acafdaac68535d026dff
  • MD5 08a42a7c573b8087febd68220d1d25d6
  • SHA1 16457693e9e3fba703ee35caabe85874fec9ab45
  • SHA512 fe9f510fef836f4267acc8067c5de0a0169c19b54e47e899db65a409e42ae65df5252f8ac89ffd937fbfa6d19df212537b545af99284ac8fc1ebdf86065a9547
  • SSDEEP 98304:roIPEYQC0fQYM/3H8KRLnufGKapfzSwN0Pt5T5p8wr1/AMy08yI9HmcAiHr1vvf4:8ItFbd/HpRLnmGjpf+w2PrT38wttw7XY
  • TLSH
    T12156337E0C96A61AEC0972B08CD9A6E3C7557CC436C88D46A44CEF83F7B26DD1A24D53
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionchromelevatorsanta_stealerhacktoolspywarestealer

  • Detects ChromElevator

  • Detects SantaStealer

  • Family: ChromElevator

    ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

    hacktoolchromelevator

  • Family: SantaStealer

    SantaStealer is an information stealer written in C.

    stealersanta_stealer

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Looks for VMWare services registry key.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1