89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85 | Triage

Sharing

General

Target

89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85
Size

3.0MB
Sample

221123-q15f4sad8z
MD5

91406e61fa3aa437c7efa66a4ea9ba0f
SHA1

27c6f6a493dd74b0d5c52437b07f1ab31e5a2e57
SHA256

89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85
SHA512

5b141804e5806b87c298447c853ddcd37ac729200c91b1640eb00906224c5f0df10fd826c37bfa3cb886c82387bf4fb14e2e93762c24805a1a6bc3aaa2be97b1
SSDEEP

49152:iaUrAj9PxbJ2zuAiBCUwH7SlFJ5DumdOsCeT4n61dvdeR7hx9xek6uxzmy:ia4Aj6iBCUwHujDbC1n61S7nJ6Az

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85
- Size
  
  3.0MB
- MD5
  
  91406e61fa3aa437c7efa66a4ea9ba0f
- SHA1
  
  27c6f6a493dd74b0d5c52437b07f1ab31e5a2e57
- SHA256
  
  89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85
- SHA512
  
  5b141804e5806b87c298447c853ddcd37ac729200c91b1640eb00906224c5f0df10fd826c37bfa3cb886c82387bf4fb14e2e93762c24805a1a6bc3aaa2be97b1
- SSDEEP
  
  49152:iaUrAj9PxbJ2zuAiBCUwH7SlFJ5DumdOsCeT4n61dvdeR7hx9xek6uxzmy:ia4Aj6iBCUwHujDbC1n61S7nJ6Az
Score

8^/10

adware discovery persistence spyware stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer