Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-09-2024 20:19
Static task
static1
Behavioral task
behavioral1
Sample
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd.exe
Resource
win10v2004-20240802-en
General
-
Target
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd.exe
-
Size
8.6MB
-
MD5
daac772e21c3729ae4b4c83a7a48cc74
-
SHA1
4d4c02ede65e642b6a3d299c83f538b9c2486abe
-
SHA256
ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd
-
SHA512
3b05c8888d0250f9281f03c37fbf48717722b8f39956eb2dde36e14a8678549dfb4d1bc002f441c9c9fb96e262707b12f88f93e7484e18f8c32fc0c69fba7ee3
-
SSDEEP
196608:KntEzJSR+wCfXMjAD+k5NL29LyxCx4A+pppcA3fZEdpiWyUQg:KtEEPAbq9LnxOI2y1yUQg
Malware Config
Signatures
-
An open source browser data exporter written in golang. 6 IoCs
resource yara_rule behavioral1/memory/2340-2-0x0000000000DA0000-0x0000000002B19000-memory.dmp family_hackbrowserdata behavioral1/memory/2340-3-0x0000000000DA0000-0x0000000002B19000-memory.dmp family_hackbrowserdata behavioral1/memory/2340-8-0x0000000000DA0000-0x0000000002B19000-memory.dmp family_hackbrowserdata behavioral1/memory/2340-5-0x0000000000DA0000-0x0000000002B19000-memory.dmp family_hackbrowserdata behavioral1/memory/2340-4-0x0000000000DA0000-0x0000000002B19000-memory.dmp family_hackbrowserdata behavioral1/memory/2340-6-0x0000000000DA0000-0x0000000002B19000-memory.dmp family_hackbrowserdata -
HackBrowserData
An open source golang web browser extractor.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2340 ead38fce547c6469862fb519732e0295a4c72159ad24b065a6165e613ebd50fd.exe