27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63
Size

244KB
Sample

221124-l66h5saf7z
MD5

17c90fb4c2d6c8503a52212d68740319
SHA1

fe8483c33b14ca013da36afdc1278ac220b8bd3d
SHA256

27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63
SHA512

c978c6303a89125723aeb2cadcbeb945ed1f7341bb956f231f6c3104c02f4aa68a61041a59ee800edcea1623bf8b76bd6e84f6e987749462ab43ef0cc07af74a
SSDEEP

6144:1ND+xKDtDAr6GBzeS5bzQiOTn+fD3sUGMBjMu:KxCDAm0eS5bzQiOTn+fD39Bj

Score

10^/10

adware evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63
- Size
  
  244KB
- MD5
  
  17c90fb4c2d6c8503a52212d68740319
- SHA1
  
  fe8483c33b14ca013da36afdc1278ac220b8bd3d
- SHA256
  
  27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63
- SHA512
  
  c978c6303a89125723aeb2cadcbeb945ed1f7341bb956f231f6c3104c02f4aa68a61041a59ee800edcea1623bf8b76bd6e84f6e987749462ab43ef0cc07af74a
- SSDEEP
  
  6144:1ND+xKDtDAr6GBzeS5bzQiOTn+fD3sUGMBjMu:KxCDAm0eS5bzQiOTn+fD39Bj
Score

10^/10

adware evasion spyware stealer trojan
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwareevasionspywarestealertrojan

behavioral2

adwareevasionspywarestealertrojan