50929680d9df1efdc8dfa33b7c133918a522c12a885ddc7492a41ee03a7d35c7 | Triage

Sharing

General

Target

2024-06-07_c6f5f95f5b859195a57b5fb9a375e250_bkransomware
Size

233KB
Sample

240607-wqklvabf8s
MD5

c6f5f95f5b859195a57b5fb9a375e250
SHA1

dd11d3db12d97fd7835dc317a9e38b5a608bf30e
SHA256

50929680d9df1efdc8dfa33b7c133918a522c12a885ddc7492a41ee03a7d35c7
SHA512

b3accd2e3fd3bbafc7b4715cf8eaf77518f06b06d04696153b64db1ecd6b498cdc3a52c577d3e77204362816255edbbce693ee84756b3fcded202d9b2b0cba94
SSDEEP

6144:hZMaz0a+LFNfYdiDqsZ0WgLJ8x0DGd+PRK/s0:hS00TLF6diDZuJ8Oyd+PcU0

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-06-07_c6f5f95f5b859195a57b5fb9a375e250_bkransomware
- Size
  
  233KB
- MD5
  
  c6f5f95f5b859195a57b5fb9a375e250
- SHA1
  
  dd11d3db12d97fd7835dc317a9e38b5a608bf30e
- SHA256
  
  50929680d9df1efdc8dfa33b7c133918a522c12a885ddc7492a41ee03a7d35c7
- SHA512
  
  b3accd2e3fd3bbafc7b4715cf8eaf77518f06b06d04696153b64db1ecd6b498cdc3a52c577d3e77204362816255edbbce693ee84756b3fcded202d9b2b0cba94
- SSDEEP
  
  6144:hZMaz0a+LFNfYdiDqsZ0WgLJ8x0DGd+PRK/s0:hS00TLF6diDZuJ8Oyd+PcU0
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer