b8a1a859adecefdec0e57d65371f792ed8b9440e5a27f363a0dcf8375addbfd9 | Triage™

Login
Reports

Overview

overview

8

Static

static

1

file.exe

windows10-2004-x64

8

file.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 75.5MB
Sample260925-zygrpsxake
SHA256 b8a1a859adecefdec0e57d65371f792ed8b9440e5a27f363a0dcf8375addbfd9
MD5 c9381c8e97cb994c5bd01b503f31ed35
SHA1 ea9798758e44b9cbdc3c24ea0d85fb14a9826179
SHA512 3dd2c2c78418a942812790e90e32d6b166a82e0d936c94db7aa3b15c8663d2c11db922a3473b38551cf2c6a100895a62a778f95dc1644b648f24810c467de311
SSDEEP 786432:sbiIVYV7FsKUXTjdJyFV1OH0n5fj5P14Sn7V:sgVFsLGFVHZHZ7V
TLSH
T10A08AE15E3D84B16E27FC27CC2638512E7B1B4421362D7CF0595EA992F63BC1AB36263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence stealer

Static task

static1

Behavioral task

behavioral1

Sample

file.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

12 signatures

150 seconds

credential_access discovery persistence stealer

Behavioral task

behavioral2

Sample

file.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

14 signatures

150 seconds

credential_access defense_evasion discovery persistence stealer

Malware Config

Targets

- Target
  file.exe
- Size 75.5MB
- SHA256 b8a1a859adecefdec0e57d65371f792ed8b9440e5a27f363a0dcf8375addbfd9
- MD5 c9381c8e97cb994c5bd01b503f31ed35
- SHA1 ea9798758e44b9cbdc3c24ea0d85fb14a9826179
- SHA512 3dd2c2c78418a942812790e90e32d6b166a82e0d936c94db7aa3b15c8663d2c11db922a3473b38551cf2c6a100895a62a778f95dc1644b648f24810c467de311
- SSDEEP 786432:sbiIVYV7FsKUXTjdJyFV1OH0n5fj5P14Sn7V:sgVFsLGFVHZHZ7V
- TLSH
  T10A08AE15E3D84B16E27FC27CC2638512E7B1B4421362D7CF0595EA992F63BC1AB36263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery persistence stealer defense_evasion
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Modify Authentication Process

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Debugger Evasion

Modify Authentication Process

Modify Registry

Credential Access

Modify Authentication Process

Steal Web Session Cookie

Discovery

Debugger Evasion

Query Registry

System Information Discovery

System Network Configuration Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoverypersistencestealer

behavioral2

credential_accessdefense_evasiondiscoverypersistencestealer

© 2018-2026

Terms | Privacy