384b49551206dcd81a8451bf43cabd6893ecfb0b74403c79cad00f983aa2e8cb | Triage

Sharing

General

Target

2025-03-30_e300c6ca815426ca0c98052d86fb6a3f_black-basta_cobalt-strike_satacom
Size

19.1MB
Sample

250330-xsb8xsvtex
MD5

e300c6ca815426ca0c98052d86fb6a3f
SHA1

c8926ef3d95ae62bc2b487d501192d0f153bdc5a
SHA256

384b49551206dcd81a8451bf43cabd6893ecfb0b74403c79cad00f983aa2e8cb
SHA512

208262833fb265a35f75240648ed2922db05c428489e96ca29b5193304a0dc4c5aa8546fb76c9eabda40dae96c6deb2b4b904659f275d205af3b41ef138645aa
SSDEEP

393216:d3Ei9ifZaKBsRvKNqT2JtWNhqKVlInEroXRazY3BUnU4O/oHmbxMGqJ:d3bwaKS2JtEhqKVuErURp3BCU4Oymm/J

Score

7^/10

discovery persistence privilege_escalation pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  2025-03-30_e300c6ca815426ca0c98052d86fb6a3f_black-basta_cobalt-strike_satacom
- Size
  
  19.1MB
- MD5
  
  e300c6ca815426ca0c98052d86fb6a3f
- SHA1
  
  c8926ef3d95ae62bc2b487d501192d0f153bdc5a
- SHA256
  
  384b49551206dcd81a8451bf43cabd6893ecfb0b74403c79cad00f983aa2e8cb
- SHA512
  
  208262833fb265a35f75240648ed2922db05c428489e96ca29b5193304a0dc4c5aa8546fb76c9eabda40dae96c6deb2b4b904659f275d205af3b41ef138645aa
- SSDEEP
  
  393216:d3Ei9ifZaKBsRvKNqT2JtWNhqKVlInEroXRazY3BUnU4O/oHmbxMGqJ:d3bwaKS2JtEhqKVuErURp3BCU4Oymm/J
Score

7^/10

discovery persistence privilege_escalation spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Information Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistenceprivilege_escalationspywarestealer