9a2f338dfc540710ef62855c70a9cd0f3e8e26c4601f871976d639deef47d535 | Triage

Sharing

General

Target

9a2f338dfc540710ef62855c70a9cd0f3e8e26c4601f871976d639deef47d535
Size

2.8MB
Sample

221123-qvlf2seh73
MD5

5d187e7b449ac5aae6744ed0937e6ef4
SHA1

97ffe466f82be3053caf705656e35b254fffdcd5
SHA256

9a2f338dfc540710ef62855c70a9cd0f3e8e26c4601f871976d639deef47d535
SHA512

5908e7d926594f2fb12d5865437efd511ac6c4ffc883b95cb6573f77fccf40d09356ae968005046be0edfab2537f1f120e66fbd4398e7c2796c953613bd1808b
SSDEEP

49152:gmFFz1qYxLj6bgaGaQbcobiT4r7whEsLNwSXmsSjuyZleTeyFxanmZRaCUmpUQxB:rlXIGjsI3VJ5ZlqHMFCFa0BM

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  9a2f338dfc540710ef62855c70a9cd0f3e8e26c4601f871976d639deef47d535
- Size
  
  2.8MB
- MD5
  
  5d187e7b449ac5aae6744ed0937e6ef4
- SHA1
  
  97ffe466f82be3053caf705656e35b254fffdcd5
- SHA256
  
  9a2f338dfc540710ef62855c70a9cd0f3e8e26c4601f871976d639deef47d535
- SHA512
  
  5908e7d926594f2fb12d5865437efd511ac6c4ffc883b95cb6573f77fccf40d09356ae968005046be0edfab2537f1f120e66fbd4398e7c2796c953613bd1808b
- SSDEEP
  
  49152:gmFFz1qYxLj6bgaGaQbcobiT4r7whEsLNwSXmsSjuyZleTeyFxanmZRaCUmpUQxB:rlXIGjsI3VJ5ZlqHMFCFa0BM
Score

8^/10

adware discovery persistence spyware stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer