87d267bf6105e887e5fc1844500827ee4eb696a47ac276187b32c15082e1aeb3 | Triage

Sharing

General

Target

2024-05-26_a3e8b6ac427ae3c9c9af689fffde468b_bkransomware
Size

71KB
Sample

240526-hglkwsac3t
MD5

a3e8b6ac427ae3c9c9af689fffde468b
SHA1

f0e16def91c35f320ca57877814b056128a98fe9
SHA256

87d267bf6105e887e5fc1844500827ee4eb696a47ac276187b32c15082e1aeb3
SHA512

9fd2c4293022c93654d0987dba1f20d2c6c82eb7de1f008cd7d66cb121123edb01eb3fd742e2b009338aa92d3a7d200c8b47795850fb0dc9938c518fe24797c0
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTl:ZRpAyazIliazTl

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-26_a3e8b6ac427ae3c9c9af689fffde468b_bkransomware
- Size
  
  71KB
- MD5
  
  a3e8b6ac427ae3c9c9af689fffde468b
- SHA1
  
  f0e16def91c35f320ca57877814b056128a98fe9
- SHA256
  
  87d267bf6105e887e5fc1844500827ee4eb696a47ac276187b32c15082e1aeb3
- SHA512
  
  9fd2c4293022c93654d0987dba1f20d2c6c82eb7de1f008cd7d66cb121123edb01eb3fd742e2b009338aa92d3a7d200c8b47795850fb0dc9938c518fe24797c0
- SSDEEP
  
  1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTl:ZRpAyazIliazTl
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer