taurus | f20ff51110a2afc08e58fbfbb856043bc4a1510a95b46ccbf3770f7f8344214a

General

Target
c1b0a127dd1f69399a03c8653776df9c
Size 235KB
Sample231228-ef1rmsehdl
SHA256 f20ff51110a2afc08e58fbfbb856043bc4a1510a95b46ccbf3770f7f8344214a
MD5 c1b0a127dd1f69399a03c8653776df9c
SHA1 c66ab86b8bff31d74f077ec989887ba0aa186763
SHA512 42583ed265820fd6c272e4513972314c4db0c401d939d932528320cfc78ceabccfb17b314a77657dcadf53843ce5316aa7f6a88f1700a0797b2caf45c1d4e93b
SSDEEP 6144:QRSe86YHbe3UuWmX8DVNC8zzt6+KXDJ1DKmB87vN2U5TUjr:UfuuNsDfxatTB870Njr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  c1b0a127dd1f69399a03c8653776df9c
- Size 235KB
- SHA256 f20ff51110a2afc08e58fbfbb856043bc4a1510a95b46ccbf3770f7f8344214a
- MD5 c1b0a127dd1f69399a03c8653776df9c
- SHA1 c66ab86b8bff31d74f077ec989887ba0aa186763
- SHA512 42583ed265820fd6c272e4513972314c4db0c401d939d932528320cfc78ceabccfb17b314a77657dcadf53843ce5316aa7f6a88f1700a0797b2caf45c1d4e93b
- SSDEEP 6144:QRSe86YHbe3UuWmX8DVNC8zzt6+KXDJ1DKmB87vN2U5TUjr:UfuuNsDfxatTB870Njr
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

taurus discovery spyware stealer trojan
- Taurus Stealer
  Taurus is an infostealer first seen in June 2020.
  trojan stealer taurus
- Taurus Stealer payload
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Taurus Stealer

Taurus Stealer payload

Deletes itself

Reads user/profile data of web browsers

Accesses 2FA software files, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2