da98c518343157c16d6ecc10207741faf722e702fc2202e82f3bcb201fa7147c | Triage

Sharing

General

Target

da98c518343157c16d6ecc10207741faf722e702fc2202e82f3bcb201fa7147c
Size

2.1MB
Sample

221124-l5v11sae91
MD5

aa3362bd6ad1a10b24e414fc8d0fb08c
SHA1

443a7535789a6b5fbc618259b153e17edad43786
SHA256

da98c518343157c16d6ecc10207741faf722e702fc2202e82f3bcb201fa7147c
SHA512

24dab5fb6429d50e317c510fc7c06418324a43062bcda9e7ca7508e60c02d7f7e4e3163a78d6c6d53f83969bac18f82b7245e1e7834ccae65981eca4f750cc0d
SSDEEP

24576:h1OYdaOxTwLleYkTVug2PiL0jHM8WK5z6Sh19BUfOD4XRt1otyBNvJvMXzGK5Ihe:h1OsYLARTQ9PimJWtShQnvQsru9

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  da98c518343157c16d6ecc10207741faf722e702fc2202e82f3bcb201fa7147c
- Size
  
  2.1MB
- MD5
  
  aa3362bd6ad1a10b24e414fc8d0fb08c
- SHA1
  
  443a7535789a6b5fbc618259b153e17edad43786
- SHA256
  
  da98c518343157c16d6ecc10207741faf722e702fc2202e82f3bcb201fa7147c
- SHA512
  
  24dab5fb6429d50e317c510fc7c06418324a43062bcda9e7ca7508e60c02d7f7e4e3163a78d6c6d53f83969bac18f82b7245e1e7834ccae65981eca4f750cc0d
- SSDEEP
  
  24576:h1OYdaOxTwLleYkTVug2PiL0jHM8WK5z6Sh19BUfOD4XRt1otyBNvJvMXzGK5Ihe:h1OsYLARTQ9PimJWtShQnvQsru9
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer