ea18ad74d460aec70d1f49401a5d56b23ba90c392f1172a924f6272430bef78e | Triage

Sharing

General

Target

2024-04-28_f4bab9d986f97cf0676e07f2f6da69ed_bkransomware
Size

96KB
Sample

240428-hcy1esad2v
MD5

f4bab9d986f97cf0676e07f2f6da69ed
SHA1

4d7baa80e71cc5f31033193c8db2e5bf7842c723
SHA256

ea18ad74d460aec70d1f49401a5d56b23ba90c392f1172a924f6272430bef78e
SHA512

f28b89d0654c7a965b56eb00ac8091227b18fab035dca56efd6fe06fff03df0e106653a64a4982728f96e22a1e84ee66191ea37ab999ac188c4107e08be2be00
SSDEEP

1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTZdIQOHg26:ZhpAyazIlyazTZehA3

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-04-28_f4bab9d986f97cf0676e07f2f6da69ed_bkransomware
- Size
  
  96KB
- MD5
  
  f4bab9d986f97cf0676e07f2f6da69ed
- SHA1
  
  4d7baa80e71cc5f31033193c8db2e5bf7842c723
- SHA256
  
  ea18ad74d460aec70d1f49401a5d56b23ba90c392f1172a924f6272430bef78e
- SHA512
  
  f28b89d0654c7a965b56eb00ac8091227b18fab035dca56efd6fe06fff03df0e106653a64a4982728f96e22a1e84ee66191ea37ab999ac188c4107e08be2be00
- SSDEEP
  
  1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTZdIQOHg26:ZhpAyazIlyazTZehA3
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer