Overview

overview

10

Static

static

8

11652a5226...28.exe

windows7_x64

10

11652a5226...28.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11652a522645a5127f7d5a2e8e9acef96cdb89fd4cc649752da37381d70b9528

  • Size

    434KB

  • Sample

    220708-jd1q3shea2

  • MD5

    efb61fa61dbec5252ddefef9d91d30be

  • SHA1

    e36c298cd6fce8554737a623f65b8ea2051ff750

  • SHA256

    11652a522645a5127f7d5a2e8e9acef96cdb89fd4cc649752da37381d70b9528

  • SHA512

    b3d8aa251b330103cb5bc39ead6d8bbb09a104373b7bb12e90820c174317828792087b5afef7892598a6d0e5870be6ff63ec3b6d3f3967196117328baf9f1e50

Score
10/10
taurusdiscoveryspywarestealertrojanupx

Malware Config

Targets

    • Target

      11652a522645a5127f7d5a2e8e9acef96cdb89fd4cc649752da37381d70b9528

    • Size

      434KB

    • MD5

      efb61fa61dbec5252ddefef9d91d30be

    • SHA1

      e36c298cd6fce8554737a623f65b8ea2051ff750

    • SHA256

      11652a522645a5127f7d5a2e8e9acef96cdb89fd4cc649752da37381d70b9528

    • SHA512

      b3d8aa251b330103cb5bc39ead6d8bbb09a104373b7bb12e90820c174317828792087b5afef7892598a6d0e5870be6ff63ec3b6d3f3967196117328baf9f1e50

    Score
    10/10
    taurusdiscoveryspywarestealertrojanupx

    • Taurus Stealer

      Taurus is an infostealer first seen in June 2020.

      trojanstealertaurus

    • Taurus Stealer payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks