hackbrowserdata

General

Target

202409252346facbe2399c78708add78c97c848ecobaltstrikepoetratsnatch
Size

20.2MB
Sample

240925-hl8afs1crl
MD5

2346facbe2399c78708add78c97c848e
SHA1

76b72f8bd1e23e77e94c1d2da2eea348e5e78b67
SHA256

92df2597181f99dcf227a277ac1ddaa9965e31a9340a066c70cfa5e2690b9209
SHA512

b968b8e01c969b62a6342f08897e01c3644ca697eb06c2271e85aaf8831b6923597d4244cfb51838d9fc50e8968768c1d1dd29476f0b3c115375601b8bb774d7
SSDEEP

393216:27EtbbEgD1/gzQnSegNPCQM2/psErTmlJhjePxnI:DtbR4zQnSxJCQHscmNePxn

Score

10^/10

Malware Config

Targets

- Target
  
  202409252346facbe2399c78708add78c97c848ecobaltstrikepoetratsnatch
- Size
  
  20.2MB
- MD5
  
  2346facbe2399c78708add78c97c848e
- SHA1
  
  76b72f8bd1e23e77e94c1d2da2eea348e5e78b67
- SHA256
  
  92df2597181f99dcf227a277ac1ddaa9965e31a9340a066c70cfa5e2690b9209
- SHA512
  
  b968b8e01c969b62a6342f08897e01c3644ca697eb06c2271e85aaf8831b6923597d4244cfb51838d9fc50e8968768c1d1dd29476f0b3c115375601b8bb774d7
- SSDEEP
  
  393216:27EtbbEgD1/gzQnSegNPCQM2/psErTmlJhjePxnI:DtbR4zQnSxJCQHscmNePxn
Score

10^/10

hackbrowserdata discovery infostealer persistence privilege_escalation
- An open source browser data exporter written in golang.
- HackBrowserData
  An open source golang web browser extractor.
  infostealer hackbrowserdata
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2