kronos | aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc | Triage

Sharing

General

Target

aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc
Size

295KB
Sample

230522-jexqtahf2v
MD5

9818958e65a0a71e29a2f5e7ffa650ca
SHA1

bf4192414e8acde9d694e605d3d978ad45c0a337
SHA256

aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc
SHA512

5c7d87e6735d84e986c02ea803acc5d463a4d3305e99bea7631966154888acf9f9bd01f8a4174efe8e47b618005c4b28f698d9e3981227b5c637f5dc164ccbf3
SSDEEP

6144:JRDGVb7SvY/5pIFTBqYH3v2wgLSHSRzGbqDDtZqqDLuZcvEFQ:JNS7t/5CFTsPnSyRbDtUqnuZ2Eq

Score

10^/10

kronos banker botnet persistence spyware stealer

Malware Config

Targets

- Target
  
  aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc
- Size
  
  295KB
- MD5
  
  9818958e65a0a71e29a2f5e7ffa650ca
- SHA1
  
  bf4192414e8acde9d694e605d3d978ad45c0a337
- SHA256
  
  aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc
- SHA512
  
  5c7d87e6735d84e986c02ea803acc5d463a4d3305e99bea7631966154888acf9f9bd01f8a4174efe8e47b618005c4b28f698d9e3981227b5c637f5dc164ccbf3
- SSDEEP
  
  6144:JRDGVb7SvY/5pIFTBqYH3v2wgLSHSRzGbqDDtZqqDLuZcvEFQ:JNS7t/5CFTsPnSyRbDtUqnuZ2Eq
Score

10^/10

kronos banker botnet persistence spyware stealer
- Kronos
  banker botnet kronos
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetpersistencespywarestealer

behavioral2

kronosbankerbotnetpersistencespywarestealer