Resubmissions
14-06-2023 13:00
230614-p85w6shd9v 706-04-2023 23:11
230406-2586msfe98 708-12-2022 18:54
221208-xkg47sdh71 706-02-2022 20:38
220206-zez4yabhcl 10Analysis
-
max time kernel
71s -
max time network
41s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
06-02-2022 20:38
General
-
Target
ColdStealer.exe
-
Size
258KB
-
MD5
c41a85123af144790520f502fe190110
-
SHA1
cc85d3c7c4c4d452fc12dc5a2e9ef3ffd9c0f42b
-
SHA256
eeaf3f80e04400fa8e097fef2c84d5e32ff8c5e0cd0f46549c8651cf145ba780
-
SHA512
d64e292940b62ae04426c3681fd1df092f215acafeaf61de1df38b4d64d3e703e8d516713359c98a141c153e9248c3b7d698d6aa61ad5d0a8b990095213c80a1
Score
10/10
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer Payload 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ColdStealer.exe"C:\Users\Admin\AppData\Local\Temp\ColdStealer.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
24KB
-
Filesize
288KB
-
Filesize
24KB
-
Filesize
389.6MB