Overview

overview

10

Static

static

3

2024-09-23...ch.exe

windows7-x64

1

2024-09-23...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-23_baf7c46da51e32655e83198b601251a4_cobalt-strike_poet-rat_snatch

  • Size

    22.4MB

  • Sample

    240923-tlb3sssaqr

  • MD5

    baf7c46da51e32655e83198b601251a4

  • SHA1

    492daac637b581b65a439d0f42d534435e4bafe1

  • SHA256

    b5c3d7771db064b18ede908f78869f0e238b1721c67ea95526a393a1abf53b57

  • SHA512

    fc3da85fbb31ce188d3934d907719e6db9d9112e547964d10da253aee6c8e1bcd3a84a9bf5a69c4e040667a291220ab69dedaa34125454bada773002d23c2afa

  • SSDEEP

    393216:Tr2AyMD1/gzQnSegNPCQM2/psErTmlJhjePxnIq7Uy:n2a4zQnSxJCQHscmNePxnf

Score
10/10
hackbrowserdatadiscoveryinfostealer

Malware Config

Targets

    • Target

      2024-09-23_baf7c46da51e32655e83198b601251a4_cobalt-strike_poet-rat_snatch

    • Size

      22.4MB

    • MD5

      baf7c46da51e32655e83198b601251a4

    • SHA1

      492daac637b581b65a439d0f42d534435e4bafe1

    • SHA256

      b5c3d7771db064b18ede908f78869f0e238b1721c67ea95526a393a1abf53b57

    • SHA512

      fc3da85fbb31ce188d3934d907719e6db9d9112e547964d10da253aee6c8e1bcd3a84a9bf5a69c4e040667a291220ab69dedaa34125454bada773002d23c2afa

    • SSDEEP

      393216:Tr2AyMD1/gzQnSegNPCQM2/psErTmlJhjePxnIq7Uy:n2a4zQnSxJCQHscmNePxnf

    Score
    10/10
    hackbrowserdatadiscoveryinfostealer

    • An open source browser data exporter written in golang.

    • HackBrowserData

      An open source golang web browser extractor.

      infostealerhackbrowserdata

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks