3fb78acc990e3f7b6b581cb829378e5274ed76ed5434cf2baf84c3382c0b88f1 | Triage

Sharing

General

Target

2024-09-05_8c70d0ebebffbb7b836ab837bfbbf1d4_bkransomware
Size

96KB
Sample

240905-pckala1ejd
MD5

8c70d0ebebffbb7b836ab837bfbbf1d4
SHA1

7bed4f9838b6f46da79bb7b3e28e39799f4f62df
SHA256

3fb78acc990e3f7b6b581cb829378e5274ed76ed5434cf2baf84c3382c0b88f1
SHA512

8de7ad58072b8b5bc10fd511ed420f0927ffc9665caa830424acbde4b7deca09843fbe2b117472fbff88f23bb66026af24ca94c34dff2383b5db37f696fab7cf
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlDuazTzNF2qf:ZRpAyazIlyazT62

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-09-05_8c70d0ebebffbb7b836ab837bfbbf1d4_bkransomware
- Size
  
  96KB
- MD5
  
  8c70d0ebebffbb7b836ab837bfbbf1d4
- SHA1
  
  7bed4f9838b6f46da79bb7b3e28e39799f4f62df
- SHA256
  
  3fb78acc990e3f7b6b581cb829378e5274ed76ed5434cf2baf84c3382c0b88f1
- SHA512
  
  8de7ad58072b8b5bc10fd511ed420f0927ffc9665caa830424acbde4b7deca09843fbe2b117472fbff88f23bb66026af24ca94c34dff2383b5db37f696fab7cf
- SSDEEP
  
  1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlDuazTzNF2qf:ZRpAyazIlyazT62
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer