fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5 | Triage

Sharing

General

Target

fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5
Size

2.1MB
Sample

221124-gsdhzsgc7y
MD5

dbbe97ab97bb71ea91cf60881881b1f5
SHA1

f0f2a6ddd51daae700db48eb90cc3aab9954389d
SHA256

fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5
SHA512

4ff8ad1b2389a158df7ed36e6117593abe190002483aab16024dea211e7cbf0c6a250c09c456e162e4351ae723631c1130594d40ce2f157b7a3170e9c0f7662e
SSDEEP

24576:h1OYdaORTwLleYkTVug2PiL0jHM8WK5z6Sh19BUfOD4XRt1otyBNvJvMXzGK5Ih1:h1OsQLARTQ9PimJWtShQnvQsruu

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5
- Size
  
  2.1MB
- MD5
  
  dbbe97ab97bb71ea91cf60881881b1f5
- SHA1
  
  f0f2a6ddd51daae700db48eb90cc3aab9954389d
- SHA256
  
  fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5
- SHA512
  
  4ff8ad1b2389a158df7ed36e6117593abe190002483aab16024dea211e7cbf0c6a250c09c456e162e4351ae723631c1130594d40ce2f157b7a3170e9c0f7662e
- SSDEEP
  
  24576:h1OYdaORTwLleYkTVug2PiL0jHM8WK5z6Sh19BUfOD4XRt1otyBNvJvMXzGK5Ih1:h1OsQLARTQ9PimJWtShQnvQsruu
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer