Overview

overview

8

Static

static

a61bee9af0...05.exe

windows7-x64

8

a61bee9af0...05.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a61bee9af0e6ba828bc3b48520c602aec652d07ddced5aea93aa9d792d384105

  • Size

    2.5MB

  • Sample

    221124-z2xx4adc7y

  • MD5

    b50b2839cec51cf7ef92db6a58d60644

  • SHA1

    88fbed4dfbc48dacd58cf0771bc27b72826b1653

  • SHA256

    a61bee9af0e6ba828bc3b48520c602aec652d07ddced5aea93aa9d792d384105

  • SHA512

    104e0d35560f5622c0741828d9a8e4d8a8c7fcbdac76bc5e8c150592e311f73c51f5dd99568f05d8c914fbd51a2c11e655b395638f8429e131ef06334ae848df

  • SSDEEP

    49152:h1OsiCpYO/dJJDHhs6oxRkNfehWfNs4VGufZ9JODSTz4bkY:h1Oqly7kNfrNq4Y

Score
8/10
adwarediscoveryspywarestealer

Malware Config

Targets

    • Target

      a61bee9af0e6ba828bc3b48520c602aec652d07ddced5aea93aa9d792d384105

    • Size

      2.5MB

    • MD5

      b50b2839cec51cf7ef92db6a58d60644

    • SHA1

      88fbed4dfbc48dacd58cf0771bc27b72826b1653

    • SHA256

      a61bee9af0e6ba828bc3b48520c602aec652d07ddced5aea93aa9d792d384105

    • SHA512

      104e0d35560f5622c0741828d9a8e4d8a8c7fcbdac76bc5e8c150592e311f73c51f5dd99568f05d8c914fbd51a2c11e655b395638f8429e131ef06334ae848df

    • SSDEEP

      49152:h1OsiCpYO/dJJDHhs6oxRkNfehWfNs4VGufZ9JODSTz4bkY:h1Oqly7kNfrNq4Y

    Score
    8/10
    adwarediscoveryspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks