taurus | 52d0fdb41312a46d599e5d9bd68659e657003ca80967e18e7a11e2757af52bb3 | Triage

Submit
Reports

Overview

overview

Static

static

3

e0a2cb336e...18.exe

windows7-x64

e0a2cb336e...18.exe

windows10-2004-x64

Sharing

General

Target

e0a2cb336eb4ac91b1a7063197141dad_JaffaCakes118
Size

1.0MB
Sample

240914-vmgv4svhra
MD5

e0a2cb336eb4ac91b1a7063197141dad
SHA1

f342999fef91b90c1e12cf036b86e1a6ed0c04fe
SHA256

52d0fdb41312a46d599e5d9bd68659e657003ca80967e18e7a11e2757af52bb3
SHA512

0f81bf6b4abf2f6f074273ee23cb7aecce158615a85ee9e56ca12296b1052251e464af30a5f8c332d66d4860d135e90daca6b0a2edbba0ac5a55e0a1e4796093
SSDEEP

12288:3Gw80d8HVJJVfqWq/iXt5XeK9POudm5+R6rIhqkIHq0dp4ZDTsnDqaSftffBWkro:3Gw80d8LXqu5XeqPOEjLdTIuthA

Score

10^/10

taurus credential_access discovery spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e0a2cb336eb4ac91b1a7063197141dad_JaffaCakes118.exe

Resource

win7-20240903-en

taurus credential_access discovery spyware stealer trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

e0a2cb336eb4ac91b1a7063197141dad_JaffaCakes118.exe

Resource

win10v2004-20240802-en

taurus credential_access discovery spyware stealer trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  e0a2cb336eb4ac91b1a7063197141dad_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  e0a2cb336eb4ac91b1a7063197141dad
- SHA1
  
  f342999fef91b90c1e12cf036b86e1a6ed0c04fe
- SHA256
  
  52d0fdb41312a46d599e5d9bd68659e657003ca80967e18e7a11e2757af52bb3
- SHA512
  
  0f81bf6b4abf2f6f074273ee23cb7aecce158615a85ee9e56ca12296b1052251e464af30a5f8c332d66d4860d135e90daca6b0a2edbba0ac5a55e0a1e4796093
- SSDEEP
  
  12288:3Gw80d8HVJJVfqWq/iXt5XeK9POudm5+R6rIhqkIHq0dp4ZDTsnDqaSftffBWkro:3Gw80d8LXqu5XeqPOEjLdTIuthA
Score

10^/10

taurus credential_access discovery spyware stealer trojan
- Taurus Stealer
  Taurus is an infostealer first seen in June 2020.
  trojan stealer taurus
- Taurus Stealer payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tauruscredential_accessdiscoveryspywarestealertrojan

behavioral2

tauruscredential_accessdiscoveryspywarestealertrojan

© 2018-2024

Terms | Privacy