Overview

overview

10

Static

static

3

2024-09-23...ch.exe

windows7-x64

1

2024-09-23...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-23_7cbe4acc2760708e7190b160585eee77_cobalt-strike_poet-rat_snatch

  • Size

    22.4MB

  • Sample

    240923-te21ms1gmk

  • MD5

    7cbe4acc2760708e7190b160585eee77

  • SHA1

    01e7fece2462724c7ce6d5a9152500a09dfcd667

  • SHA256

    1402b75764fd726cf62364af9d6bf9449e3415682e8d0ecbc017deb8b23808a9

  • SHA512

    c5495047b8fc4d4c81323f63a4e8feca77090f1fcb4ecbc53496c1fd609a3676fd339e9147647ce75d9e3640f3c285cb19f0988d08486077020765872e5c9200

  • SSDEEP

    393216:692DO8D1/gzQnSegNPCQM2/psErTmlJhjePxnIGuYebQZ:G2D4zQnSxJCQHscmNePxnlDebQ

Score
10/10
hackbrowserdatadiscoveryinfostealer

Malware Config

Targets

    • Target

      2024-09-23_7cbe4acc2760708e7190b160585eee77_cobalt-strike_poet-rat_snatch

    • Size

      22.4MB

    • MD5

      7cbe4acc2760708e7190b160585eee77

    • SHA1

      01e7fece2462724c7ce6d5a9152500a09dfcd667

    • SHA256

      1402b75764fd726cf62364af9d6bf9449e3415682e8d0ecbc017deb8b23808a9

    • SHA512

      c5495047b8fc4d4c81323f63a4e8feca77090f1fcb4ecbc53496c1fd609a3676fd339e9147647ce75d9e3640f3c285cb19f0988d08486077020765872e5c9200

    • SSDEEP

      393216:692DO8D1/gzQnSegNPCQM2/psErTmlJhjePxnIGuYebQZ:G2D4zQnSxJCQHscmNePxnlDebQ

    Score
    10/10
    hackbrowserdatadiscoveryinfostealer

    • An open source browser data exporter written in golang.

    • HackBrowserData

      An open source golang web browser extractor.

      infostealerhackbrowserdata

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks