cfca02bab4f80d8f50c661470c6baeeb327edca204177cc796fb89161f96ee1c | Triage

Sharing

General

Target

cfca02bab4f80d8f50c661470c6baeeb327edca204177cc796fb89161f96ee1c
Size

4.4MB
Sample

221124-xl1myaga2x
MD5

23ec5fae163f047e9061a045ce996561
SHA1

60e3d62b836f1957d00cad40179e8c0183eaf1e1
SHA256

cfca02bab4f80d8f50c661470c6baeeb327edca204177cc796fb89161f96ee1c
SHA512

9bbcc9d5540974543f59034e3392a84e471ab6ffd5ac53bd79c07bdd6ea94543d756eb71d2eb6730a4a83d7131530467f7cb78bc0dba442645979b9fe42166c4
SSDEEP

49152:cKk0d1vZSO6E3aDmxup4ZdGKvghxfki1xEOCrZguQaZ8hpTQd1S:r/vZGQa/KcPfWZggZspsd1

Score

8^/10

adware discovery persistence stealer

Malware Config

Targets

- Target
  
  cfca02bab4f80d8f50c661470c6baeeb327edca204177cc796fb89161f96ee1c
- Size
  
  4.4MB
- MD5
  
  23ec5fae163f047e9061a045ce996561
- SHA1
  
  60e3d62b836f1957d00cad40179e8c0183eaf1e1
- SHA256
  
  cfca02bab4f80d8f50c661470c6baeeb327edca204177cc796fb89161f96ee1c
- SHA512
  
  9bbcc9d5540974543f59034e3392a84e471ab6ffd5ac53bd79c07bdd6ea94543d756eb71d2eb6730a4a83d7131530467f7cb78bc0dba442645979b9fe42166c4
- SSDEEP
  
  49152:cKk0d1vZSO6E3aDmxup4ZdGKvghxfki1xEOCrZguQaZ8hpTQd1S:r/vZGQa/KcPfWZggZspsd1
Score

8^/10

adware discovery persistence stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencestealer

behavioral2

adwarediscoverypersistencestealer