General
-
Target
https://www.google.com/search?q=virusmaker&rlz=1C1AVFC_enCZ881CZ881&oq=virusmaker&aqs=chrome..69i57j0i10l2j0i10i30l3j5i30i44.3750j0j7&sourceid=chrome&ie=UTF-8
-
Sample
201129-zlf2scqkhj
Static task
static1
URLScan task
urlscan1
Sample
https://www.google.com/search?q=virusmaker&rlz=1C1AVFC_enCZ881CZ881&oq=virusmaker&aqs=chrome..69i57j0i10l2j0i10i30l3j5i30i44.3750j0j7&sourceid=chrome&ie=UTF-8
Behavioral task
behavioral1
Sample
https://www.google.com/search?q=virusmaker&rlz=1C1AVFC_enCZ881CZ881&oq=virusmaker&aqs=chrome..69i57j0i10l2j0i10i30l3j5i30i44.3750j0j7&sourceid=chrome&ie=UTF-8
Resource
win10v20201028
Malware Config
Targets
-
-
Target
https://www.google.com/search?q=virusmaker&rlz=1C1AVFC_enCZ881CZ881&oq=virusmaker&aqs=chrome..69i57j0i10l2j0i10i30l3j5i30i44.3750j0j7&sourceid=chrome&ie=UTF-8
Score8/10-
Executes dropped EXE
-
Modifies WinLogon to allow AutoLogon
Enables rebooting of the machine without requiring login credentials.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
JavaScript code in executable
-