d801b67f8b5ee1fd9a883756bf2515434880b52a6232f59c377ba88fdc42af90 | Triage

Sharing

General

Target

2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware
Size

918KB
Sample

240501-dv7ytsef91
MD5

e486cc9bd900567fc44273f7d716e9a0
SHA1

7019449445b1a4484aef30704b2f846a2f0c4e01
SHA256

d801b67f8b5ee1fd9a883756bf2515434880b52a6232f59c377ba88fdc42af90
SHA512

ab71c32591950b8dc8ca21a3d73d36bcacd3e56622209da6d4e60d8af53f4eef8b87a7ba078072f7f62f524406e0b87145ce6903ebf106aaa51da93c129741f8
SSDEEP

24576:DCinrKrk8l4PUGArGUWGifscVBcwZvXYPiJFWzbQO6XGM:DC2azkUGArqGCD3CeY/QORM

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware
- Size
  
  918KB
- MD5
  
  e486cc9bd900567fc44273f7d716e9a0
- SHA1
  
  7019449445b1a4484aef30704b2f846a2f0c4e01
- SHA256
  
  d801b67f8b5ee1fd9a883756bf2515434880b52a6232f59c377ba88fdc42af90
- SHA512
  
  ab71c32591950b8dc8ca21a3d73d36bcacd3e56622209da6d4e60d8af53f4eef8b87a7ba078072f7f62f524406e0b87145ce6903ebf106aaa51da93c129741f8
- SSDEEP
  
  24576:DCinrKrk8l4PUGArGUWGifscVBcwZvXYPiJFWzbQO6XGM:DC2azkUGArqGCD3CeY/QORM
Score

7^/10

persistence spyware stealer discovery
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

discoverypersistencespywarestealer