f82b63410d14c666ce9186b623d8a711dd6424d4831f1e775cc9b922a0de5e06 | Triage

Sharing

General

Target

2024-06-20_468d816677c7d019a42d3b3237edaa03_bkransomware
Size

135KB
Sample

240620-p5w5vssfmr
MD5

468d816677c7d019a42d3b3237edaa03
SHA1

78b52296b54d0ad849ed742ec43794440fcc3d74
SHA256

f82b63410d14c666ce9186b623d8a711dd6424d4831f1e775cc9b922a0de5e06
SHA512

2ca9ecda91f96c9961280e74cc4d3e8c05df3fcc1af7f5d79d3f13c210f54d43ef1e88592f60b1d7cb5d46f857a2cf1ace071c0a6e2957bc18708495ed7d5fae
SSDEEP

3072:ZRpAyazIliazTQNVkZ3KY1I4Vq1NFlQ8Jw:xZ8az0GKYPw1NnQ9

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-06-20_468d816677c7d019a42d3b3237edaa03_bkransomware
- Size
  
  135KB
- MD5
  
  468d816677c7d019a42d3b3237edaa03
- SHA1
  
  78b52296b54d0ad849ed742ec43794440fcc3d74
- SHA256
  
  f82b63410d14c666ce9186b623d8a711dd6424d4831f1e775cc9b922a0de5e06
- SHA512
  
  2ca9ecda91f96c9961280e74cc4d3e8c05df3fcc1af7f5d79d3f13c210f54d43ef1e88592f60b1d7cb5d46f857a2cf1ace071c0a6e2957bc18708495ed7d5fae
- SSDEEP
  
  3072:ZRpAyazIliazTQNVkZ3KY1I4Vq1NFlQ8Jw:xZ8az0GKYPw1NnQ9
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer