a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e | Triage

Resubmissions

22-05-2020 23:12

200522-zx87kfkqfx 3

22-05-2020 23:06

200522-l1sckhd8p6 7

Sharing

General

Target

openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Size

442KB
Sample

200522-l1sckhd8p6
MD5

85430baed3398695717b0263807cf97c
SHA1

fffbee923cea216f50fce5d54219a188a5100f41
SHA256

a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512

06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Score

7^/10

evasion spyware trojan

Malware Config

Targets

- Target
  
  gmpopenh264.dll
- Size
  
  997KB
- MD5
  
  fe3355639648c417e8307c6d051e3e37
- SHA1
  
  f54602d4b4778da21bc97c7238fc66aa68c8ee34
- SHA256
  
  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
- SHA512
  
  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
Score

7^/10

spyware evasion trojan
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Modifies system certificate store
  evasion spyware trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

spywareevasiontrojan

behavioral2