ab9afa0b58f9af678cdf5a6d665a61f910f0a48a52c92008b6ff46d708e1c7bd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab9afa0b58f9af678cdf5a6d665a61f910f0a48a52c92008b6ff46d708e1c7bd
Size

222KB
Sample

221029-wvl1gaabbr
MD5

84647b86c763139a380bf3f6c1bc2f90
SHA1

b2115074a2eb6e4972207dbd842ddbc60d5b799c
SHA256

ab9afa0b58f9af678cdf5a6d665a61f910f0a48a52c92008b6ff46d708e1c7bd
SHA512

5af400438719c5df5d5d571f1b1222589f1a201959c30320c13a6dfa25d7722d4104a283f069e3f508dd21877a380b1c05123c606110484d15d84439fea5417b
SSDEEP

6144:O5563h+PFiFTE07KZpdkQxtaoTC9WnlCAPw3qux:nZFTEMQxtl+WnkAP

Score

8^/10

adware persistence stealer

Malware Config

Targets

- Target
  
  ab9afa0b58f9af678cdf5a6d665a61f910f0a48a52c92008b6ff46d708e1c7bd
- Size
  
  222KB
- MD5
  
  84647b86c763139a380bf3f6c1bc2f90
- SHA1
  
  b2115074a2eb6e4972207dbd842ddbc60d5b799c
- SHA256
  
  ab9afa0b58f9af678cdf5a6d665a61f910f0a48a52c92008b6ff46d708e1c7bd
- SHA512
  
  5af400438719c5df5d5d571f1b1222589f1a201959c30320c13a6dfa25d7722d4104a283f069e3f508dd21877a380b1c05123c606110484d15d84439fea5417b
- SSDEEP
  
  6144:O5563h+PFiFTE07KZpdkQxtaoTC9WnlCAPw3qux:nZFTEMQxtl+WnkAP
Score

8^/10

adware persistence stealer
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

adwarepersistencestealer