kronos | f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f | Triage™

Login
Reports

Overview

overview

Static

static

f51130b15d...8f.exe

windows7_x64

f51130b15d...8f.exe

windows10_x64

Sharing

Copy URL Twitter E-mail

General

Target
f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f
Size 376KB
Sample220129-29r3xsbbcp
SHA256 f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f
MD5 be536f6ca164de4f9b7a6b2a1d1fd8d5
SHA1 42af42114efc18afe726a38bfbf3fd36036a69f8
SHA512 c442f342f1c1c01b9400005c3d74a5374b9d4b50c784dc8897500f2e62861dc8c52b53d2dd23f93a712094fc4a01f50cdaebf42c9568c8016a1a3bfc0132e3f4
MD5 SHA1 SHA512

Score

10^/10

kronos banker botnet evasion persistence

Static task

static1

Behavioral task

behavioral1

Sample

f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f.exe

Resource

win7-en-20211208

windows7_x64

0 signatures

0 seconds

kronos banker botnet evasion persistence

Behavioral task

behavioral2

Sample

f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f.exe

Resource

win10-en-20211208

windows10_x64

0 signatures

0 seconds

kronos banker botnet persistence

Malware Config

Targets

- Target
  f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f
- Size 376KB
- SHA256 f51130b15d2bc913d92a6a2f4d489c1ae67deb7f59a2dc0ba85a91d1afe1a98f
- MD5 be536f6ca164de4f9b7a6b2a1d1fd8d5
- SHA1 42af42114efc18afe726a38bfbf3fd36036a69f8
- SHA512 c442f342f1c1c01b9400005c3d74a5374b9d4b50c784dc8897500f2e62861dc8c52b53d2dd23f93a712094fc4a01f50cdaebf42c9568c8016a1a3bfc0132e3f4
- MD5 SHA1 SHA512
Score

10^/10

kronos banker botnet evasion persistence
- Kronos
  banker botnet kronos
- Modifies security service
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetevasionpersistence

behavioral2

kronosbankerbotnetpersistence

© 2018-2026

Terms | Privacy