1f050b9709b440f2b160bfb0c154f543edb3728284ab6e452257a0c30398c75f | Triage

Sharing

General

Target

2024-05-07_bde096cba0ff587be5fb48dd9d877131_bkransomware
Size

595KB
Sample

240507-nxvfmaed91
MD5

bde096cba0ff587be5fb48dd9d877131
SHA1

6fe40b37e08f657388682dde5eb77b052e12bd13
SHA256

1f050b9709b440f2b160bfb0c154f543edb3728284ab6e452257a0c30398c75f
SHA512

b8ce971f3ab795c2954382724a81fa9bc7de39c80305c0d15c141a79f2e5627032278ecbfb495e434dc20e60ad7506d8a2a5ef326544c2b88439d4bb5e645d8a
SSDEEP

12288:hS0ixAOhHYsuok3TsGWf8zobgdR2Al7l5x2cD9h8gYFh6:DtO0JTFWf8cbgLx9udq

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-07_bde096cba0ff587be5fb48dd9d877131_bkransomware
- Size
  
  595KB
- MD5
  
  bde096cba0ff587be5fb48dd9d877131
- SHA1
  
  6fe40b37e08f657388682dde5eb77b052e12bd13
- SHA256
  
  1f050b9709b440f2b160bfb0c154f543edb3728284ab6e452257a0c30398c75f
- SHA512
  
  b8ce971f3ab795c2954382724a81fa9bc7de39c80305c0d15c141a79f2e5627032278ecbfb495e434dc20e60ad7506d8a2a5ef326544c2b88439d4bb5e645d8a
- SSDEEP
  
  12288:hS0ixAOhHYsuok3TsGWf8zobgdR2Al7l5x2cD9h8gYFh6:DtO0JTFWf8cbgLx9udq
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer