cfc2df936823bb9fa8fd06c4bb02a00b23bfcb91ffa37193420f0025cefa4ae4 | Triage

Sharing

General

Target

2024-10-12_821faf420d3771fa5fb903b5b031c555_bkransomware
Size

595KB
Sample

241012-kn2lsssdnb
MD5

821faf420d3771fa5fb903b5b031c555
SHA1

dcd2ecf229422b35e11abecc0e018b8d829babb8
SHA256

cfc2df936823bb9fa8fd06c4bb02a00b23bfcb91ffa37193420f0025cefa4ae4
SHA512

f1853602df5eb5b21f6af200ef3e4b0c650c270eed708c710b30f24fe73fc34b74950b181cf741c3c666a6410b08e6801995ed2d044c9a5e1e5c77056f1a5828
SSDEEP

12288:hS0OWhYsioAunt7539x8edAi69+fTIQfhMgoR3Ptf1NlDT4HmPathKWUr7rwf:DOOYPop753r8edt69+f5gf1Nx4GiWWUE

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-10-12_821faf420d3771fa5fb903b5b031c555_bkransomware
- Size
  
  595KB
- MD5
  
  821faf420d3771fa5fb903b5b031c555
- SHA1
  
  dcd2ecf229422b35e11abecc0e018b8d829babb8
- SHA256
  
  cfc2df936823bb9fa8fd06c4bb02a00b23bfcb91ffa37193420f0025cefa4ae4
- SHA512
  
  f1853602df5eb5b21f6af200ef3e4b0c650c270eed708c710b30f24fe73fc34b74950b181cf741c3c666a6410b08e6801995ed2d044c9a5e1e5c77056f1a5828
- SSDEEP
  
  12288:hS0OWhYsioAunt7539x8edAi69+fTIQfhMgoR3Ptf1NlDT4HmPathKWUr7rwf:DOOYPop753r8edt69+f5gf1Nx4GiWWUE
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer