keybase | c60afc854f90caae1a139a41ed602da346a218fd05835f10d6e44ef9110d9f45

General

Target
2026-10-21_6deb6e7df1f3b3e0ccf084b2d06475d2_elex_stop
Size 2.1MB
Sample261022-2az99aav2j
SHA256 c60afc854f90caae1a139a41ed602da346a218fd05835f10d6e44ef9110d9f45
MD5 6deb6e7df1f3b3e0ccf084b2d06475d2
SHA1 872d79d5f467a8710b0f662a940e7aeff5ef6afd
SHA512 d83777151f227a0b125d9741aa84944a157a99157f902b7d5a20d17c3d72f4f6d73443550f71fb94f6d88be50d5337dcc5e3a2b7e7e00cc59cbf68fdbacf63b8
SSDEEP 24576:hbCj2sObHtqQEdNYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7WE:hbCjPKNidNFIbBMyE
TLSH
T1DAA5D0C6F2EA40E6DC023FF5582567C78B344736473840597BAA3D498F234A9C16EBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-21_6deb6e7df1f3b3e0ccf084b2d06475d2_elex_stop
- Size 2.1MB
- SHA256 c60afc854f90caae1a139a41ed602da346a218fd05835f10d6e44ef9110d9f45
- MD5 6deb6e7df1f3b3e0ccf084b2d06475d2
- SHA1 872d79d5f467a8710b0f662a940e7aeff5ef6afd
- SHA512 d83777151f227a0b125d9741aa84944a157a99157f902b7d5a20d17c3d72f4f6d73443550f71fb94f6d88be50d5337dcc5e3a2b7e7e00cc59cbf68fdbacf63b8
- SSDEEP 24576:hbCj2sObHtqQEdNYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7WE:hbCjPKNidNFIbBMyE
- TLSH
  T1DAA5D0C6F2EA40E6DC023FF5582567C78B344736473840597BAA3D498F234A9C16EBB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution keybase persistence spyware stealer
- Detects KeyBase stealer
- Family: KeyBase
  KeyBase is a .NET credential stealer and keylogger first emerging in February 2015.
  stealer keybase
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables referencing many email and collaboration clients. Observed in information steale
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2