kronos | aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc | Triage™

Login
Reports

Overview

overview

Static

static

3

aad98f57ce...bc.exe

windows7-x64

aad98f57ce...bc.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc
Size 295KB
Sample230522-jexqtahf2v
SHA256 aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc
MD5 9818958e65a0a71e29a2f5e7ffa650ca
SHA1 bf4192414e8acde9d694e605d3d978ad45c0a337
SHA512 5c7d87e6735d84e986c02ea803acc5d463a4d3305e99bea7631966154888acf9f9bd01f8a4174efe8e47b618005c4b28f698d9e3981227b5c637f5dc164ccbf3
SSDEEP 6144:JRDGVb7SvY/5pIFTBqYH3v2wgLSHSRzGbqDDtZqqDLuZcvEFQ:JNS7t/5CFTsPnSyRbDtUqnuZ2Eq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kronos banker botnet persistence spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc.exe

Resource

win7-20230220-en

windows7-x64

9 signatures

150 seconds

kronos banker botnet persistence spyware stealer

Behavioral task

behavioral2

Sample

aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

8 signatures

150 seconds

kronos banker botnet persistence spyware stealer

Malware Config

Targets

- Target
  aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc
- Size 295KB
- SHA256 aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc
- MD5 9818958e65a0a71e29a2f5e7ffa650ca
- SHA1 bf4192414e8acde9d694e605d3d978ad45c0a337
- SHA512 5c7d87e6735d84e986c02ea803acc5d463a4d3305e99bea7631966154888acf9f9bd01f8a4174efe8e47b618005c4b28f698d9e3981227b5c637f5dc164ccbf3
- SSDEEP 6144:JRDGVb7SvY/5pIFTBqYH3v2wgLSHSRzGbqDDtZqqDLuZcvEFQ:JNS7t/5CFTsPnSyRbDtUqnuZ2Eq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

kronos banker botnet persistence spyware stealer
- Kronos
  banker botnet kronos
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetpersistencespywarestealer

behavioral2

kronosbankerbotnetpersistencespywarestealer

© 2018-2026

Terms | Privacy