Overview

overview

10

Static

static

3

2024-09-25...ch.exe

windows7-x64

1

2024-09-25...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-25_2346facbe2399c78708add78c97c848e_cobalt-strike_poet-rat_snatch

  • Size

    20.2MB

  • Sample

    240925-a1s53sxenh

  • MD5

    2346facbe2399c78708add78c97c848e

  • SHA1

    76b72f8bd1e23e77e94c1d2da2eea348e5e78b67

  • SHA256

    92df2597181f99dcf227a277ac1ddaa9965e31a9340a066c70cfa5e2690b9209

  • SHA512

    b968b8e01c969b62a6342f08897e01c3644ca697eb06c2271e85aaf8831b6923597d4244cfb51838d9fc50e8968768c1d1dd29476f0b3c115375601b8bb774d7

  • SSDEEP

    393216:27EtbbEgD1/gzQnSegNPCQM2/psErTmlJhjePxnI:DtbR4zQnSxJCQHscmNePxn

Score
10/10
hackbrowserdatadiscoveryinfostealer

Malware Config

Targets

    • Target

      2024-09-25_2346facbe2399c78708add78c97c848e_cobalt-strike_poet-rat_snatch

    • Size

      20.2MB

    • MD5

      2346facbe2399c78708add78c97c848e

    • SHA1

      76b72f8bd1e23e77e94c1d2da2eea348e5e78b67

    • SHA256

      92df2597181f99dcf227a277ac1ddaa9965e31a9340a066c70cfa5e2690b9209

    • SHA512

      b968b8e01c969b62a6342f08897e01c3644ca697eb06c2271e85aaf8831b6923597d4244cfb51838d9fc50e8968768c1d1dd29476f0b3c115375601b8bb774d7

    • SSDEEP

      393216:27EtbbEgD1/gzQnSegNPCQM2/psErTmlJhjePxnI:DtbR4zQnSxJCQHscmNePxn

    Score
    10/10
    hackbrowserdatadiscoveryinfostealer

    • An open source browser data exporter written in golang.

    • HackBrowserData

      An open source golang web browser extractor.

      infostealerhackbrowserdata

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks