2c4f5ec9ddf31935bdfaa6bc5addd83fb0e1d7f327f9113d727f420c4f56bdde | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-11_2eedd3787269c9c34397ebc43c857c2f_bkransomware
Size

153KB
Sample

240512-zxc25afg3y
MD5

2eedd3787269c9c34397ebc43c857c2f
SHA1

de0f6affb51e1dfb494954e513655aae55369dd2
SHA256

2c4f5ec9ddf31935bdfaa6bc5addd83fb0e1d7f327f9113d727f420c4f56bdde
SHA512

10be8ac3113eca1002b75e3b8cf68f9fba8ae19a693f9d4d38e106c3d6ba50aca657e4c8309c8781ed7082d3d282d13249dac0765623a515b29e2c682dd03b3a
SSDEEP

3072:ZRpAyazIliazTZ8YfJi53V+TGzcuoLMK14U6U6liRIsbh:xZ8azNxipV+TGQNoK5WM

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-11_2eedd3787269c9c34397ebc43c857c2f_bkransomware
- Size
  
  153KB
- MD5
  
  2eedd3787269c9c34397ebc43c857c2f
- SHA1
  
  de0f6affb51e1dfb494954e513655aae55369dd2
- SHA256
  
  2c4f5ec9ddf31935bdfaa6bc5addd83fb0e1d7f327f9113d727f420c4f56bdde
- SHA512
  
  10be8ac3113eca1002b75e3b8cf68f9fba8ae19a693f9d4d38e106c3d6ba50aca657e4c8309c8781ed7082d3d282d13249dac0765623a515b29e2c682dd03b3a
- SSDEEP
  
  3072:ZRpAyazIliazTZ8YfJi53V+TGzcuoLMK14U6U6liRIsbh:xZ8azNxipV+TGQNoK5WM
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer