Extracted

• • Target
    1dc5f3577f8222ea168886dc0323bd6c9f4dec649ad7532396180e7bf24c8560
  • Size 3.5MB
  • SHA256 1dc5f3577f8222ea168886dc0323bd6c9f4dec649ad7532396180e7bf24c8560
  • MD5 3ef63b56a9bd5212db71b433c6ff3fcb
  • SHA1 af47e7353e2d63453fcb76a51bbd693db325092e
  • SHA512 d1e7b67d337a5f7d2913cc116d20ed08d5061bb98e7115f4e7890f1a5a07ab10a9ba8d2186636424eb4a17ee63803825e1a8dcf738ab2610a36c49730d40f99c
  • SSDEEP 49152:Igy+zSHv2MHI2QEVmuiUCIC21zl65HjgMrJ5+9ujAmZ3s1TkWAgv:I6aUlreYjNe3
  • TLSH
    T18F064A07AD9108F6D099E735C8775252BAB0BC4C5B3123D32EA0BA782F767C0AD79B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  4a9d4a401684fc862456f0d14966ac04c05c544bf406bbda607937bb570cd4892959cad4collectioncredential_accessdiscoveryaokigahararagestealerspywarestealer
  • Custom signature

    Detects Rage-Stealer

    Detects Rage-stealer aka Priv8.

  • Family: Aokigahara

    Aokigahara is a Windows stealer written in C.

    stealeraokigahara

  • Family: ragestealer

    ragestealer

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2