e114396505ed4928d8dbc11ba61f156492182375db563b7d72c239a7c59de4fc | Triage

Sharing

General

Target

2024-05-31_940e32111bba4b580e3df9ed85aefb5e_bkransomware
Size

71KB
Sample

240531-xzmm8sab5w
MD5

940e32111bba4b580e3df9ed85aefb5e
SHA1

42cc8d1c20b3b71afed1ec9ea07e66d7a43c8233
SHA256

e114396505ed4928d8dbc11ba61f156492182375db563b7d72c239a7c59de4fc
SHA512

afdbff49d2c8c3516de6c3c18ef1093f74c8c3068f1a9ab3425570bf673cee51798a1f905a9492250381877a6e79be1981181ccc3ceab6818aa6e01beeb44590
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTq:ZRpAyazIliazTq

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-31_940e32111bba4b580e3df9ed85aefb5e_bkransomware
- Size
  
  71KB
- MD5
  
  940e32111bba4b580e3df9ed85aefb5e
- SHA1
  
  42cc8d1c20b3b71afed1ec9ea07e66d7a43c8233
- SHA256
  
  e114396505ed4928d8dbc11ba61f156492182375db563b7d72c239a7c59de4fc
- SHA512
  
  afdbff49d2c8c3516de6c3c18ef1093f74c8c3068f1a9ab3425570bf673cee51798a1f905a9492250381877a6e79be1981181ccc3ceab6818aa6e01beeb44590
- SSDEEP
  
  1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTq:ZRpAyazIliazTq
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer