Overview

overview

10

Static

static

3

2024-09-23...ch.exe

windows7-x64

1

2024-09-23...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-23_22549968edc23bf55d97dfca93669ff2_cobalt-strike_poet-rat_snatch

  • Size

    22.4MB

  • Sample

    240923-s7g1ha1cpj

  • MD5

    22549968edc23bf55d97dfca93669ff2

  • SHA1

    8f6eafbbedb38841d742e2919a00bfa0dc0f8f7c

  • SHA256

    d5dc214b3447ff4d4cf1b34412c9d74eb4e95cda840bca80892c6fe130acc0e6

  • SHA512

    2156b003919c55bb9b41a03283bec32c2ab0ce99e24f0f267970b748c98218040a02a5e49696d66f1814a51a386336dc473ed4db16f1c0c9675f945af8d13457

  • SSDEEP

    393216:ar2MreD1/gzQnSegNPCQM2/psErTmlJhjePxnIgaheZrV:U214zQnSxJCQHscmNePxnVahehV

Score
10/10
hackbrowserdatadiscoveryinfostealer

Malware Config

Targets

    • Target

      2024-09-23_22549968edc23bf55d97dfca93669ff2_cobalt-strike_poet-rat_snatch

    • Size

      22.4MB

    • MD5

      22549968edc23bf55d97dfca93669ff2

    • SHA1

      8f6eafbbedb38841d742e2919a00bfa0dc0f8f7c

    • SHA256

      d5dc214b3447ff4d4cf1b34412c9d74eb4e95cda840bca80892c6fe130acc0e6

    • SHA512

      2156b003919c55bb9b41a03283bec32c2ab0ce99e24f0f267970b748c98218040a02a5e49696d66f1814a51a386336dc473ed4db16f1c0c9675f945af8d13457

    • SSDEEP

      393216:ar2MreD1/gzQnSegNPCQM2/psErTmlJhjePxnIgaheZrV:U214zQnSxJCQHscmNePxnVahehV

    Score
    10/10
    hackbrowserdatadiscoveryinfostealer

    • An open source browser data exporter written in golang.

    • HackBrowserData

      An open source golang web browser extractor.

      infostealerhackbrowserdata

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks