ce2edab323345c50f3cbfa91dcad2f22a7134cda799e694c074e63aec59a839b | Triage

Sharing

General

Target

ce2edab323345c50f3cbfa91dcad2f22a7134cda799e694c074e63aec59a839b
Size

3.0MB
Sample

221123-qa9m5sge7y
MD5

c08127490354a53d7a9011c71f6ddcdb
SHA1

a06266b3044d56c27ad834e7bf599199ec9c05e6
SHA256

ce2edab323345c50f3cbfa91dcad2f22a7134cda799e694c074e63aec59a839b
SHA512

df52e43913606b0e6040814b89e6b390df40037ab2eb172ea03e67659358e2810671d427e81aede89428831eeae77a9c01504141724d5eb3c8aeb1483e5b4411
SSDEEP

49152:HVulgOaEUiwghIrWFZfToxu2FwfmqW8ntcJd1s65QwJv5NfsQ:1GUiwWiWXb7278ntcn13b

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  ce2edab323345c50f3cbfa91dcad2f22a7134cda799e694c074e63aec59a839b
- Size
  
  3.0MB
- MD5
  
  c08127490354a53d7a9011c71f6ddcdb
- SHA1
  
  a06266b3044d56c27ad834e7bf599199ec9c05e6
- SHA256
  
  ce2edab323345c50f3cbfa91dcad2f22a7134cda799e694c074e63aec59a839b
- SHA512
  
  df52e43913606b0e6040814b89e6b390df40037ab2eb172ea03e67659358e2810671d427e81aede89428831eeae77a9c01504141724d5eb3c8aeb1483e5b4411
- SSDEEP
  
  49152:HVulgOaEUiwghIrWFZfToxu2FwfmqW8ntcJd1s65QwJv5NfsQ:1GUiwWiWXb7278ntcn13b
Score

8^/10

adware discovery persistence spyware stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer