14eb691613882a284f6934bc32d338d6c5da92ad2957a5289caf26085584c55d | Triage

Sharing

General

Target

14eb691613882a284f6934bc32d338d6c5da92ad2957a5289caf26085584c55d
Size

2.1MB
Sample

221123-3q7jyada86
MD5

2545bf9d42b9b6a5f787b9a018863565
SHA1

30104ab68ef47bba3f5137492d8528f44688733f
SHA256

14eb691613882a284f6934bc32d338d6c5da92ad2957a5289caf26085584c55d
SHA512

9279f69a2d0f2639187d913899b0d4ece5590d743b42a9875a1eae4f3971589d42ecca55ff59cb64943f6a05d3478538c1dc1fd5967e92d4b04d7eae10ff06b8
SSDEEP

49152:h1OsuhvaZG1MVEtzijkTvu2x/uw4B8FHFF6l:h1OxvaxMziy3u

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  14eb691613882a284f6934bc32d338d6c5da92ad2957a5289caf26085584c55d
- Size
  
  2.1MB
- MD5
  
  2545bf9d42b9b6a5f787b9a018863565
- SHA1
  
  30104ab68ef47bba3f5137492d8528f44688733f
- SHA256
  
  14eb691613882a284f6934bc32d338d6c5da92ad2957a5289caf26085584c55d
- SHA512
  
  9279f69a2d0f2639187d913899b0d4ece5590d743b42a9875a1eae4f3971589d42ecca55ff59cb64943f6a05d3478538c1dc1fd5967e92d4b04d7eae10ff06b8
- SSDEEP
  
  49152:h1OsuhvaZG1MVEtzijkTvu2x/uw4B8FHFF6l:h1OxvaxMziy3u
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

adwarediscoveryspywarestealer