0db3b9babc357b10a92d9183635b230647f9057779705ab4a443c613362ba036 | Triage

Sharing

General

Target

0db3b9babc357b10a92d9183635b230647f9057779705ab4a443c613362ba036
Size

516KB
Sample

221124-f363lsef9x
MD5

70cf5d3e24c2cabf937097ea90d043bd
SHA1

35656e895c3575ec2f655253e87740ca69ba2dce
SHA256

0db3b9babc357b10a92d9183635b230647f9057779705ab4a443c613362ba036
SHA512

0926ed0800e7a8d71acb0a636c935126553316b4e2c5d596ddd70d86ca8de94af6c1e63a16e8fb4c55049316f596f515531ef543bf0b06a23a7180b3be7efdf3
SSDEEP

12288:2eNXljx3WfYg5g94oZVkQHxqLFr0AhtLRRNf6mINoxb4M:pHx3aY59tH6LRvSJNoxb4M

Score

8^/10

adware bootkit persistence stealer

Malware Config

Targets

- Target
  
  0db3b9babc357b10a92d9183635b230647f9057779705ab4a443c613362ba036
- Size
  
  516KB
- MD5
  
  70cf5d3e24c2cabf937097ea90d043bd
- SHA1
  
  35656e895c3575ec2f655253e87740ca69ba2dce
- SHA256
  
  0db3b9babc357b10a92d9183635b230647f9057779705ab4a443c613362ba036
- SHA512
  
  0926ed0800e7a8d71acb0a636c935126553316b4e2c5d596ddd70d86ca8de94af6c1e63a16e8fb4c55049316f596f515531ef543bf0b06a23a7180b3be7efdf3
- SSDEEP
  
  12288:2eNXljx3WfYg5g94oZVkQHxqLFr0AhtLRRNf6mINoxb4M:pHx3aY59tH6LRvSJNoxb4M
Score

8^/10

adware bootkit persistence stealer
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarebootkitpersistencestealer

behavioral2

adwarebootkitpersistencestealer