f64298ab1394a6bd229de18b15f1991caccd6fb6d579b3c968de4241beb3251f | Triage

Sharing

General

Target

2024-04-28_80d1a696584849037be8341ad5e70905_bkransomware
Size

135KB
Sample

240428-t3kq9scb3t
MD5

80d1a696584849037be8341ad5e70905
SHA1

0fb5eed91a7fcd98e18703d77d16a13c1b2d1ee9
SHA256

f64298ab1394a6bd229de18b15f1991caccd6fb6d579b3c968de4241beb3251f
SHA512

33941f1c5061513265c04232de76f15bc8377107a0d106aa1b7609bfa111339ab0d5b2dc3a03c59b15be7d428618cdc76ec899c9ee3efb1494c47a561a0b19f6
SSDEEP

3072:ZRpAyazIliazTBlm+fojBIxRCgokd2X6K:xZ8azllgjBISgoXR

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-04-28_80d1a696584849037be8341ad5e70905_bkransomware
- Size
  
  135KB
- MD5
  
  80d1a696584849037be8341ad5e70905
- SHA1
  
  0fb5eed91a7fcd98e18703d77d16a13c1b2d1ee9
- SHA256
  
  f64298ab1394a6bd229de18b15f1991caccd6fb6d579b3c968de4241beb3251f
- SHA512
  
  33941f1c5061513265c04232de76f15bc8377107a0d106aa1b7609bfa111339ab0d5b2dc3a03c59b15be7d428618cdc76ec899c9ee3efb1494c47a561a0b19f6
- SSDEEP
  
  3072:ZRpAyazIliazTBlm+fojBIxRCgokd2X6K:xZ8azllgjBISgoXR
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer