ba415b4ebcb0b5a592c2ecbbf95765e54c32fa20b6617595adb294e3b40a6324 | Triage

Sharing

General

Target

2024-05-24_2a63f576879a9738b176b5036b73c2a3_bkransomware
Size

71KB
Sample

240524-r5expahf4t
MD5

2a63f576879a9738b176b5036b73c2a3
SHA1

4446063948b99f1e43407707b9989c8b2ae021fc
SHA256

ba415b4ebcb0b5a592c2ecbbf95765e54c32fa20b6617595adb294e3b40a6324
SHA512

fde8cc2db4bdd4df7e13331dbb603fb4aca5760d3684ca51baa1924053980b991dd17529685d28afcd3def2fbcc2577ca695e76eaddcd06bdf8309a6ab439d21
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT1:ZRpAyazIliazT1

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-24_2a63f576879a9738b176b5036b73c2a3_bkransomware
- Size
  
  71KB
- MD5
  
  2a63f576879a9738b176b5036b73c2a3
- SHA1
  
  4446063948b99f1e43407707b9989c8b2ae021fc
- SHA256
  
  ba415b4ebcb0b5a592c2ecbbf95765e54c32fa20b6617595adb294e3b40a6324
- SHA512
  
  fde8cc2db4bdd4df7e13331dbb603fb4aca5760d3684ca51baa1924053980b991dd17529685d28afcd3def2fbcc2577ca695e76eaddcd06bdf8309a6ab439d21
- SSDEEP
  
  1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT1:ZRpAyazIliazT1
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer