Extracted

• • Target
    42a7a7f00c5bc728b55b49a20d8266a84df393c363da27299b3c159de418cb26.bin.exe
  • Size 525KB
  • SHA256 42a7a7f00c5bc728b55b49a20d8266a84df393c363da27299b3c159de418cb26
  • MD5 489b62c8307745f79f44e312d37cb63a
  • SHA1 c040fb6de6134ccd2b7c3708dbda25ea406fa555
  • SHA512 d70f431cfd9db6961581d1fc131e870b370c900620684af0803a3e39a394c138fa9c668a78a61e414345abae5cf4d9f3209fda0208984a79bc8135d2b28bc801
  • SSDEEP 6144:HBDkDb4d/ypztyX2Nr7Dd2dsDH5VhIf0Cp855c8Pc12cUWLFn4TA6rRy1QL3fCHV:6Hg/ysgvpPWfLaK8Pc1PLoRkU3u
  • TLSH
    T119B48D57B66683BCD12EC07893569673FA32B4CA02327DBF02E456303E59E516F2CB19
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionransomwarespywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral1behavioral2