ee54c04eef4ebef683e969a5be5fc91c518ca3dd9960a71edbc7d58535b1f51c | Triage

Sharing

General

Target

2024-05-20_52a1e8f7ef4a59d97af988b7a2e68042_bkransomware
Size

131KB
Sample

240520-wjhhxaca6x
MD5

52a1e8f7ef4a59d97af988b7a2e68042
SHA1

a39dc92579301f62e4ff2379d5f85961d49ad1ed
SHA256

ee54c04eef4ebef683e969a5be5fc91c518ca3dd9960a71edbc7d58535b1f51c
SHA512

1abdd1722cebc4ae91fd9efc4290ce6c49dbdf436b222288176601148c7df8521231d62c10eeb869add64d12b98f8f370add5244ab8bf713f9d088e622471cb7
SSDEEP

3072:ZRpAyazIliazThPqPSe+DI8iEMP9j75hi5Vs1Sac:xZ8aztPqPSe+cZL/hi5

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-20_52a1e8f7ef4a59d97af988b7a2e68042_bkransomware
- Size
  
  131KB
- MD5
  
  52a1e8f7ef4a59d97af988b7a2e68042
- SHA1
  
  a39dc92579301f62e4ff2379d5f85961d49ad1ed
- SHA256
  
  ee54c04eef4ebef683e969a5be5fc91c518ca3dd9960a71edbc7d58535b1f51c
- SHA512
  
  1abdd1722cebc4ae91fd9efc4290ce6c49dbdf436b222288176601148c7df8521231d62c10eeb869add64d12b98f8f370add5244ab8bf713f9d088e622471cb7
- SSDEEP
  
  3072:ZRpAyazIliazThPqPSe+DI8iEMP9j75hi5Vs1Sac:xZ8aztPqPSe+cZL/hi5
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer