Overview

overview

10

Static

static

3

2024-09-23...ch.exe

windows7-x64

1

2024-09-23...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-23_4a27f40979c27b52e3c7d3fa3069c246_cobalt-strike_poet-rat_snatch

  • Size

    22.4MB

  • Sample

    240923-s99hja1dqr

  • MD5

    4a27f40979c27b52e3c7d3fa3069c246

  • SHA1

    7b2d0df594741ce1ea9d6b1b4106ba15fad8e837

  • SHA256

    6587e68c8e53df8abb6bbd312feaf054bf9986df2db98c5850b1fd92469c3053

  • SHA512

    e305aacc185d51f8feb942e6591e2b9f8f7f690bcd2dc643541ef794bd9af3c6d534029779f7b8b9c5583e6e0619f406f969d168a7dabd453a30c1c4806bf4ea

  • SSDEEP

    393216:1C2db4TD1/gzQnSegNPCQM2/psErTmlJhjePxnIX2Gf:Q2di4zQnSxJCQHscmNePxn82G

Score
10/10
hackbrowserdatadiscoveryinfostealer

Malware Config

Targets

    • Target

      2024-09-23_4a27f40979c27b52e3c7d3fa3069c246_cobalt-strike_poet-rat_snatch

    • Size

      22.4MB

    • MD5

      4a27f40979c27b52e3c7d3fa3069c246

    • SHA1

      7b2d0df594741ce1ea9d6b1b4106ba15fad8e837

    • SHA256

      6587e68c8e53df8abb6bbd312feaf054bf9986df2db98c5850b1fd92469c3053

    • SHA512

      e305aacc185d51f8feb942e6591e2b9f8f7f690bcd2dc643541ef794bd9af3c6d534029779f7b8b9c5583e6e0619f406f969d168a7dabd453a30c1c4806bf4ea

    • SSDEEP

      393216:1C2db4TD1/gzQnSegNPCQM2/psErTmlJhjePxnIX2Gf:Q2di4zQnSxJCQHscmNePxn82G

    Score
    10/10
    hackbrowserdatadiscoveryinfostealer

    • An open source browser data exporter written in golang.

    • HackBrowserData

      An open source golang web browser extractor.

      infostealerhackbrowserdata

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks