kronos | f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f | Triage

Submit
Reports

Overview

overview

Static

static

f51130b15d...8f.exe

windows7_x64

f51130b15d...8f.exe

windows10_x64

Sharing

General

Target

f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f
Size

376KB
Sample

220129-29r3xsbbcp
MD5

be536f6ca164de4f9b7a6b2a1d1fd8d5
SHA1

42af42114efc18afe726a38bfbf3fd36036a69f8
SHA256

f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f
SHA512

c442f342f1c1c01b9400005c3d74a5374b9d4b50c784dc8897500f2e62861dc8c52b53d2dd23f93a712094fc4a01f50cdaebf42c9568c8016a1a3bfc0132e3f4

Score

10^/10

kronos banker botnet evasion persistence

Static task

static1

Behavioral task

behavioral1

Sample

f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f.exe

Resource

win7-en-20211208

kronos banker botnet evasion persistence

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f.exe

Resource

win10-en-20211208

kronos banker botnet persistence

windows10_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f
- Size
  
  376KB
- MD5
  
  be536f6ca164de4f9b7a6b2a1d1fd8d5
- SHA1
  
  42af42114efc18afe726a38bfbf3fd36036a69f8
- SHA256
  
  f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f
- SHA512
  
  c442f342f1c1c01b9400005c3d74a5374b9d4b50c784dc8897500f2e62861dc8c52b53d2dd23f93a712094fc4a01f50cdaebf42c9568c8016a1a3bfc0132e3f4
Score

10^/10

kronos banker botnet evasion persistence
- Kronos
  banker botnet kronos
- Modifies security service
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetevasionpersistence

behavioral2

kronosbankerbotnetpersistence

© 2018-2025

Terms | Privacy