Overview

overview

10

Static

static

9d394831f1...e5.exe

windows7_x64

8

9d394831f1...e5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d394831f18846d25b678ad8ef8688b07e2fe95f202b24ace0e5a667f26c1ee5

  • Size

    1.0MB

  • Sample

    220427-vl7edaaahp

  • MD5

    8a7b53712f61a0902b54d35c4ef06c2a

  • SHA1

    d25797f2629a827f606024cc51a2bddb796d4452

  • SHA256

    9d394831f18846d25b678ad8ef8688b07e2fe95f202b24ace0e5a667f26c1ee5

  • SHA512

    f92b60577db8ac397df39fd01481ca285bdb9b4249c3e641e8c2d71d3ea98c58ea66ab9897ea1fd1798da5c134ee50c0f3f87e38299c626577b24bd8f95308cf

Score
10/10
tauruspersistencespywarestealertrojan

Malware Config

Targets

    • Target

      9d394831f18846d25b678ad8ef8688b07e2fe95f202b24ace0e5a667f26c1ee5

    • Size

      1.0MB

    • MD5

      8a7b53712f61a0902b54d35c4ef06c2a

    • SHA1

      d25797f2629a827f606024cc51a2bddb796d4452

    • SHA256

      9d394831f18846d25b678ad8ef8688b07e2fe95f202b24ace0e5a667f26c1ee5

    • SHA512

      f92b60577db8ac397df39fd01481ca285bdb9b4249c3e641e8c2d71d3ea98c58ea66ab9897ea1fd1798da5c134ee50c0f3f87e38299c626577b24bd8f95308cf

    Score
    10/10
    persistencetaurusspywarestealertrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Taurus Stealer

      Taurus is an infostealer first seen in June 2020.

      trojanstealertaurus

    • Taurus Stealer Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks