General

  • Target

    2024-05-27_318a6fda0dd3c3d2535b301868d28506_bkransomware

  • Size

    712KB

  • Sample

    240527-whklwadd36

  • MD5

    318a6fda0dd3c3d2535b301868d28506

  • SHA1

    eeaa3e4418620af8a34595ca588579edc4861e23

  • SHA256

    b9840b462b4f1b11c4ba80ac83f8d7565b1aabd2c70996a4194c44b73b9d30e9

  • SHA512

    a41f972ab1374668549275d4d99fd8cb6070658ad3de87c64edab0b252b782cb561c4ee29f447cb33941d2a9024546888c1a6f6f6b49c4be959a720bee1b93ad

  • SSDEEP

    12288:jtOw6Baz6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:x6Bs6LaRFdGJm0Q3WKVSwdr13Ek0VA

Malware Config

Targets

    • Target

      2024-05-27_318a6fda0dd3c3d2535b301868d28506_bkransomware

    • Size

      712KB

    • MD5

      318a6fda0dd3c3d2535b301868d28506

    • SHA1

      eeaa3e4418620af8a34595ca588579edc4861e23

    • SHA256

      b9840b462b4f1b11c4ba80ac83f8d7565b1aabd2c70996a4194c44b73b9d30e9

    • SHA512

      a41f972ab1374668549275d4d99fd8cb6070658ad3de87c64edab0b252b782cb561c4ee29f447cb33941d2a9024546888c1a6f6f6b49c4be959a720bee1b93ad

    • SSDEEP

      12288:jtOw6Baz6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:x6Bs6LaRFdGJm0Q3WKVSwdr13Ek0VA

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks