Overview

overview

10

Static

static

3

2025-06-24...er.exe

windows10-2004-x64

2025-06-24...er.exe

windows11-21h2-x64

Resubmissions

25/06/2025, 12:29

250625-pn1fysyns910

24/06/2025, 07:33

250624-jdrs6sylv810

Sharing

Copy URL Twitter E-mail

General

  • Target
    2025-06-24_aa62b3905be9b49551a07bc16eaad2ff_cobalt-strike_dosia_frostygoop_luca-stealer_quasar-rat_sliver
  • Size 2.0MB
  • Sample250624-jdrs6sylv8
  • SHA256 27d90611f005db3a25a4211cf8f69fb46097c6c374905d7207b30e87d296e1b3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target
      2025-06-24_aa62b3905be9b49551a07bc16eaad2ff_cobalt-strike_dosia_frostygoop_luca-stealer_quasar-rat_sliver
    • Size 2.0MB
    • SHA256 27d90611f005db3a25a4211cf8f69fb46097c6c374905d7207b30e87d296e1b3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasionevasionexecutionimpactransomwarespywarestealer

    • Disables service(s)

      defense_evasionexecution

    • Clears Windows event logs

      defense_evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (240) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Disables regular backups

      Uses wbadmin.exe to disable Windows backups.

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

PowerShell

1
T1059.001

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

4
T1070

Clear Windows Event Logs

1
T1070.001

File Deletion

3
T1070.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

5
T1490

Service Stop

1
T1489

Tasks