4b414e61815490dba0e1ddc768d352ee7a172ef1f70af18cd3d1543bee4906fb | Triage

Sharing

General

Target

2024-05-30_15ba3205a1d47ea2cfc61d5be52ccc39_bkransomware_karagany
Size

1.3MB
Sample

240530-lezlhsea26
MD5

15ba3205a1d47ea2cfc61d5be52ccc39
SHA1

142bb47edd8c0cdc874cd677fa21f942dc310cd4
SHA256

4b414e61815490dba0e1ddc768d352ee7a172ef1f70af18cd3d1543bee4906fb
SHA512

70f3c5ee3287d6705530a5927b341c08a5a2a5e0a3caf64ceb2c32c3466195bf9c29acc7d6bfb92359b8dbf27f0a802caa55f7819fe442daabd6bf443c5ff23a
SSDEEP

12288:GvXk1EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ak1EsqjnhMgeiCl7G0nehbGZpbD

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  2024-05-30_15ba3205a1d47ea2cfc61d5be52ccc39_bkransomware_karagany
- Size
  
  1.3MB
- MD5
  
  15ba3205a1d47ea2cfc61d5be52ccc39
- SHA1
  
  142bb47edd8c0cdc874cd677fa21f942dc310cd4
- SHA256
  
  4b414e61815490dba0e1ddc768d352ee7a172ef1f70af18cd3d1543bee4906fb
- SHA512
  
  70f3c5ee3287d6705530a5927b341c08a5a2a5e0a3caf64ceb2c32c3466195bf9c29acc7d6bfb92359b8dbf27f0a802caa55f7819fe442daabd6bf443c5ff23a
- SSDEEP
  
  12288:GvXk1EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ak1EsqjnhMgeiCl7G0nehbGZpbD
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2