cornflake | 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 | Triage™

Login
Reports

Overview

overview

Static

static

918fa52ae4...93.exe

windows10-2004-x64

918fa52ae4...93.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
Size 7.7MB
Sample260814-vnqjmseq21
SHA256 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
MD5 fba867df17721879df9d8dcca68d6900
SHA1 510af9bb00ff5d4a6856b1291af55db9f6e13551
SHA512 b467c408efcb8d86fe01c90a6fdb597480dfa9da93e5f802c9ebe53679e62c52de0316fa4bf4124c85d8f78e7528903f8b93ac95e838549c04027e46f9cdf006
SSDEEP 49152:/4sfnDspRPNLTR8GPHJ6dI7CmwewbJnzZQBuK37/Vviizf0VZ/OMnz0DTPIyOj+1:/4sPgzBqCJZT0fTSrgBrsES
TLSH
T103864A07EDA555E9C4ADD2318AB691127B727C490B3027E31BA0F6243F77BE06EB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

cornflake midnight_blizzard apt persistence rat stealer

Static task

static1

3 signatures

apt midnight_blizzard rat stealer cornflake

Behavioral task

behavioral1

Sample

918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

7 signatures

150 seconds

midnight_blizzard apt cornflake persistence rat stealer

Behavioral task

behavioral2

Sample

918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

midnight_blizzard apt cornflake persistence rat stealer

Malware Config

Targets

- Target
  918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
- Size 7.7MB
- SHA256 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
- MD5 fba867df17721879df9d8dcca68d6900
- SHA1 510af9bb00ff5d4a6856b1291af55db9f6e13551
- SHA512 b467c408efcb8d86fe01c90a6fdb597480dfa9da93e5f802c9ebe53679e62c52de0316fa4bf4124c85d8f78e7528903f8b93ac95e838549c04027e46f9cdf006
- SSDEEP 49152:/4sfnDspRPNLTR8GPHJ6dI7CmwewbJnzZQBuK37/Vviizf0VZ/OMnz0DTPIyOj+1:/4sPgzBqCJZT0fTSrgBrsES
- TLSH
  T103864A07EDA555E9C4ADD2318AB691127B727C490B3027E31BA0F6243F77BE06EB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

midnight_blizzard apt cornflake persistence rat stealer
- Detects CornFlake RAT
  apt midnight_blizzard
- Family: CornFlake
  CornFlake is a Windows RAT and stealer written in Golang, used by Midnight Blizzard aka Storm-2945.
  rat stealer cornflake
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

aptmidnight_blizzardratstealercornflake

behavioral1

midnight_blizzardaptcornflakepersistenceratstealer

behavioral2

midnight_blizzardaptcornflakepersistenceratstealer

© 2018-2026

Terms | Privacy