58bd63672b8922d92efc5b7d1f240403d53de5c1c68cc915fcdea2e38aeb01c5 | Triage

Sharing

General

Target

58bd63672b8922d92efc5b7d1f240403d53de5c1c68cc915fcdea2e38aeb01c5
Size

2.0MB
Sample

221124-ftl13sbb58
MD5

c846316ad9b02c145937884cfb9abe3e
SHA1

9f41030dbded0256396fd6c5a563d8777284bb72
SHA256

58bd63672b8922d92efc5b7d1f240403d53de5c1c68cc915fcdea2e38aeb01c5
SHA512

77d33106d5359e8a79d79577b828765a9d3bb41d729fdc80f556e6936b51d1bf05dd2576694f2e547c0e61c34ea3ccbdfb7e7a862b3277e9a89c37d1a7cf65e5
SSDEEP

24576:h1OYdaO2fFu+THyENGBKZCtEZ8r4uamh/U6zEjCPkqXsEWBV1Bsi6uRJaEsrWmx5:h1Os594ZP8lhfzEj4lXsEa3XQETomaF

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  58bd63672b8922d92efc5b7d1f240403d53de5c1c68cc915fcdea2e38aeb01c5
- Size
  
  2.0MB
- MD5
  
  c846316ad9b02c145937884cfb9abe3e
- SHA1
  
  9f41030dbded0256396fd6c5a563d8777284bb72
- SHA256
  
  58bd63672b8922d92efc5b7d1f240403d53de5c1c68cc915fcdea2e38aeb01c5
- SHA512
  
  77d33106d5359e8a79d79577b828765a9d3bb41d729fdc80f556e6936b51d1bf05dd2576694f2e547c0e61c34ea3ccbdfb7e7a862b3277e9a89c37d1a7cf65e5
- SSDEEP
  
  24576:h1OYdaO2fFu+THyENGBKZCtEZ8r4uamh/U6zEjCPkqXsEWBV1Bsi6uRJaEsrWmx5:h1Os594ZP8lhfzEj4lXsEa3XQETomaF
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer