kronos | 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166 | Triage™

Login
Reports

Overview

overview

Static

static

3

e8ab73bd31...18.exe

windows7-x64

e8ab73bd31...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
e8ab73bd31591fa5337be49241f8a7d8_JaffaCakes118
Size 314KB
Sample241212-2w382asjfl
SHA256 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
MD5 e8ab73bd31591fa5337be49241f8a7d8
SHA1 c00ea2df72fe2ed1536e4f80edff39c7ff3a2f5a
SHA512 d257b5a6ba7a20c8835fe5f0553a481e628f89893a96df8e07779c00db28294d736e66dd904c6618b85820af2394040711c0ea45aeaf1e6f05e983b82f56fd5e
SSDEEP 6144:CWQ8QntTwcMT0RyE0h2D9AxxTlNKDPj9q:tQfta0RaMA/mL5q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kronos banker botnet discovery evasion persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e8ab73bd31591fa5337be49241f8a7d8_JaffaCakes118.exe

Resource

win7-20241023-en

windows7-x64

13 signatures

150 seconds

kronos banker botnet discovery evasion persistence

Behavioral task

behavioral2

Sample

e8ab73bd31591fa5337be49241f8a7d8_JaffaCakes118.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  e8ab73bd31591fa5337be49241f8a7d8_JaffaCakes118
- Size 314KB
- SHA256 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
- MD5 e8ab73bd31591fa5337be49241f8a7d8
- SHA1 c00ea2df72fe2ed1536e4f80edff39c7ff3a2f5a
- SHA512 d257b5a6ba7a20c8835fe5f0553a481e628f89893a96df8e07779c00db28294d736e66dd904c6618b85820af2394040711c0ea45aeaf1e6f05e983b82f56fd5e
- SSDEEP 6144:CWQ8QntTwcMT0RyE0h2D9AxxTlNKDPj9q:tQfta0RaMA/mL5q
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

kronos banker botnet discovery evasion persistence
- Kronos
  banker botnet kronos
- Kronos family
  kronos
- Modifies security service
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetdiscoveryevasionpersistence

behavioral2

© 2018-2026

Terms | Privacy