323ceb0a2820303564544ef641777f4f2cd65e4f514607d5c37a73684ce4495b | Triage

Sharing

General

Target

2024-05-24_5620da37e9ccd45c5e3eedd9f703266a_bkransomware_karagany
Size

677KB
Sample

240524-12vy6sdb26
MD5

5620da37e9ccd45c5e3eedd9f703266a
SHA1

78f230767fe8912398292d6205c727d998187d92
SHA256

323ceb0a2820303564544ef641777f4f2cd65e4f514607d5c37a73684ce4495b
SHA512

e45593ed8f1b12ab4e6241c74a7b009aa162b9af7d893ca09755e32209624ef23a7e5ad900ba478fde4fff2586597fb7afe4c4849de5011b0c7ad81baa45429e
SSDEEP

12288:FvXk1lFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki0:Vk1l8NDFKYmKOF0zr31JwAlcR3QC0OXD

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  2024-05-24_5620da37e9ccd45c5e3eedd9f703266a_bkransomware_karagany
- Size
  
  677KB
- MD5
  
  5620da37e9ccd45c5e3eedd9f703266a
- SHA1
  
  78f230767fe8912398292d6205c727d998187d92
- SHA256
  
  323ceb0a2820303564544ef641777f4f2cd65e4f514607d5c37a73684ce4495b
- SHA512
  
  e45593ed8f1b12ab4e6241c74a7b009aa162b9af7d893ca09755e32209624ef23a7e5ad900ba478fde4fff2586597fb7afe4c4849de5011b0c7ad81baa45429e
- SSDEEP
  
  12288:FvXk1lFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki0:Vk1l8NDFKYmKOF0zr31JwAlcR3QC0OXD
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2