Overview

overview

8

Static

static

1

cryptolaemus

windows10-2004-x64

8

cryptolaemus

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bbbfdf66e9c773bcad95c6cd2e89a596620f417175de712269689b08f2643a40

  • Size

    8.0MB

  • Sample

    240801-kwszmawhqg

  • MD5

    7a9e91cd05bb23625354d0f46066904c

  • SHA1

    7389f1881aba1c2ba3544321bd068bbf91dfa00a

  • SHA256

    bbbfdf66e9c773bcad95c6cd2e89a596620f417175de712269689b08f2643a40

  • SHA512

    cdcd8c13f582682279463afc1a6196b65e127a0cb344632f1c2222f8f64793ae8c19547758eda94ece0bc9526b6ed13e552c3f6c9dbc2c6f157e601cbbc95c65

  • SSDEEP

    49152:BYyqyQ4SjTErF0JwHoLjhbi4zmkKm0W85GNLZLgKT/MNMNngOdTMnWAqkeKbr3kg:PgR2HoLtb

Score
8/10
credential_accessdiscoverystealer

Malware Config

Targets

    • Target

      bbbfdf66e9c773bcad95c6cd2e89a596620f417175de712269689b08f2643a40

    • Size

      8.0MB

    • MD5

      7a9e91cd05bb23625354d0f46066904c

    • SHA1

      7389f1881aba1c2ba3544321bd068bbf91dfa00a

    • SHA256

      bbbfdf66e9c773bcad95c6cd2e89a596620f417175de712269689b08f2643a40

    • SHA512

      cdcd8c13f582682279463afc1a6196b65e127a0cb344632f1c2222f8f64793ae8c19547758eda94ece0bc9526b6ed13e552c3f6c9dbc2c6f157e601cbbc95c65

    • SSDEEP

      49152:BYyqyQ4SjTErF0JwHoLjhbi4zmkKm0W85GNLZLgKT/MNMNngOdTMnWAqkeKbr3kg:PgR2HoLtb

    Score
    8/10
    credential_accessdiscoverystealer

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks