f870c82ad644e2b456ebbfe1a10534047f62fbd2658b565169ba484ae9a6ffeb | Triage

Sharing

General

Target

2024-05-24_1a90192d4b52eb536447d5a6b5e9b3d2_bkransomware
Size

96KB
Sample

240524-f38w7sfa21
MD5

1a90192d4b52eb536447d5a6b5e9b3d2
SHA1

28d73dcda2d4ff604baaa35a8b4648bd476052f3
SHA256

f870c82ad644e2b456ebbfe1a10534047f62fbd2658b565169ba484ae9a6ffeb
SHA512

b4669c62172b819843cbd16f58f25c9c0609a793a9d2e3a64e2ab0d79c7ca462f1b32ba722b2e73eac1405630edb53f854a76071195bbd5f4e07740440f2b8c4
SSDEEP

1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTYwmqAGVFvms9h:ZhpAyazIlyazTY2AYFvFh

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-24_1a90192d4b52eb536447d5a6b5e9b3d2_bkransomware
- Size
  
  96KB
- MD5
  
  1a90192d4b52eb536447d5a6b5e9b3d2
- SHA1
  
  28d73dcda2d4ff604baaa35a8b4648bd476052f3
- SHA256
  
  f870c82ad644e2b456ebbfe1a10534047f62fbd2658b565169ba484ae9a6ffeb
- SHA512
  
  b4669c62172b819843cbd16f58f25c9c0609a793a9d2e3a64e2ab0d79c7ca462f1b32ba722b2e73eac1405630edb53f854a76071195bbd5f4e07740440f2b8c4
- SSDEEP
  
  1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTYwmqAGVFvms9h:ZhpAyazIlyazTY2AYFvFh
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer