coldstealer | 597a302a8139d659cf18bc681be3013c3c8bb3472e0fde49afb671d31fb9a0c5 | Triage

Sharing

General

Target

597a302a8139d659cf18bc681be3013c3c8bb3472e0fde49afb671d31fb9a0c5
Size

161KB
Sample

220724-edv4daecc2
MD5

aa5015f2de4050e5fbde11d3f53f078e
SHA1

2486d40f1dc69cfc02d2265cf7ab961c00bac716
SHA256

597a302a8139d659cf18bc681be3013c3c8bb3472e0fde49afb671d31fb9a0c5
SHA512

d15b1c8b8e985e11fa32a33b22b4fbedbc1d17c86cd29f4ca821531dc56dbe50f91e2afae1b2bc0c926f3773d63b77cf57911d02a3b0ba17ab7c192c83361dbe

Score

10^/10

coldstealer discovery spyware stealer

Malware Config

Targets

- Target
  
  597a302a8139d659cf18bc681be3013c3c8bb3472e0fde49afb671d31fb9a0c5
- Size
  
  161KB
- MD5
  
  aa5015f2de4050e5fbde11d3f53f078e
- SHA1
  
  2486d40f1dc69cfc02d2265cf7ab961c00bac716
- SHA256
  
  597a302a8139d659cf18bc681be3013c3c8bb3472e0fde49afb671d31fb9a0c5
- SHA512
  
  d15b1c8b8e985e11fa32a33b22b4fbedbc1d17c86cd29f4ca821531dc56dbe50f91e2afae1b2bc0c926f3773d63b77cf57911d02a3b0ba17ab7c192c83361dbe
Score

10^/10

coldstealer discovery spyware stealer
- Cold Stealer
  An info stealer written in C#, first seen in Feb 2022.
  stealer coldstealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

coldstealerdiscoveryspywarestealer

behavioral2

discoveryspywarestealer