General

  • Target

    ccfaa5b52f72dbb3f3b51a4f31ea6d80ef039a4c4fa9676e512f8ca56f7b7cbb

  • Size

    196KB

  • Sample

    220427-ssyppsahf4

  • MD5

    0225c79b1de4ffeea052cc3c6fc56b99

  • SHA1

    484473600c2f2658b412e4c4d10f5450574bf5fe

  • SHA256

    ccfaa5b52f72dbb3f3b51a4f31ea6d80ef039a4c4fa9676e512f8ca56f7b7cbb

  • SHA512

    f8ecd009c04a14cf9a398a96c05e056ae7cbfeb417911ec4c5cf96029991ae315d455e4756b5946231d79e0d50507145b767e86989dce83c19195e7ad52914b2

Malware Config

Targets

    • Target

      ccfaa5b52f72dbb3f3b51a4f31ea6d80ef039a4c4fa9676e512f8ca56f7b7cbb

    • Size

      196KB

    • MD5

      0225c79b1de4ffeea052cc3c6fc56b99

    • SHA1

      484473600c2f2658b412e4c4d10f5450574bf5fe

    • SHA256

      ccfaa5b52f72dbb3f3b51a4f31ea6d80ef039a4c4fa9676e512f8ca56f7b7cbb

    • SHA512

      f8ecd009c04a14cf9a398a96c05e056ae7cbfeb417911ec4c5cf96029991ae315d455e4756b5946231d79e0d50507145b767e86989dce83c19195e7ad52914b2

    • Taurus Stealer

      Taurus is an infostealer first seen in June 2020.

    • Taurus Stealer Payload

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks