63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1 | Triage

Sharing

General

Target

63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1
Size

2.1MB
Sample

221123-vj6eashb99
MD5

cf00119f9d6d3bd2862e14f315c73e9e
SHA1

143d41f05de812a513ec6aaafc9e37b88839a8b2
SHA256

63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1
SHA512

2470e7ff2ed90d08f82d9462a70170ea11aaebbf64f20ac4057eddcb7b7a3c46217d99ad46c5cf3896830954fff35a190e84657b6c6f147b6977c0658cef0849
SSDEEP

49152:h1OsIAxPqbaJ0CqWfTAeP20icuFMDoiXrBSdCIlE05XwjXr3H:h1OtAxib7CqWfTAeP2vaDhtSdpW

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1
- Size
  
  2.1MB
- MD5
  
  cf00119f9d6d3bd2862e14f315c73e9e
- SHA1
  
  143d41f05de812a513ec6aaafc9e37b88839a8b2
- SHA256
  
  63662346441c855dd66c3ab180bee445b2f9e633d2ce46533907396abed576b1
- SHA512
  
  2470e7ff2ed90d08f82d9462a70170ea11aaebbf64f20ac4057eddcb7b7a3c46217d99ad46c5cf3896830954fff35a190e84657b6c6f147b6977c0658cef0849
- SSDEEP
  
  49152:h1OsIAxPqbaJ0CqWfTAeP20icuFMDoiXrBSdCIlE05XwjXr3H:h1OtAxib7CqWfTAeP2vaDhtSdpW
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer