Overview

overview

10

Static

static

1

rrr.txt

windows7-x64

7

rrr.txt

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rrr.txt

  • Size

    78B

  • Sample

    230820-lzyjysfh9x

  • MD5

    d15daabad874b7be048651c540cdd8b1

  • SHA1

    255d9743ffb03abdae826f61e65f3ffeb9f5adc4

  • SHA256

    91b3f6f15b629ec1145fd59c9dfd40b736a9809b4b4cbf76bbabbf9ce4014912

  • SHA512

    d5ebf4e5f25703a7ddd0fdf6f30a4ffba94e61250c378f435ba389d39711def0a08219cac6c088da2c54bc059d647497fac15f2e7618f1523ed3737af7e3ac43

Score
10/10
strelapersistencestealer

Malware Config

Targets

    • Target

      rrr.txt

    • Size

      78B

    • MD5

      d15daabad874b7be048651c540cdd8b1

    • SHA1

      255d9743ffb03abdae826f61e65f3ffeb9f5adc4

    • SHA256

      91b3f6f15b629ec1145fd59c9dfd40b736a9809b4b4cbf76bbabbf9ce4014912

    • SHA512

      d5ebf4e5f25703a7ddd0fdf6f30a4ffba94e61250c378f435ba389d39711def0a08219cac6c088da2c54bc059d647497fac15f2e7618f1523ed3737af7e3ac43

    Score
    10/10
    strelapersistencestealer

    • Strela

      An info stealer targeting mail credentials first seen in late 2022.

      stealerstrela

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks