9094f8e18f5e248b3fc2221af1f99eba1c32e5951a7c413e8dc4c1be5f5b00d4 | Triage

Sharing

General

Target

9094f8e18f5e248b3fc2221af1f99eba1c32e5951a7c413e8dc4c1be5f5b00d4
Size

2.1MB
Sample

221125-1cv8msgc63
MD5

d65241da727659af26d7b7ceb3ed8d9b
SHA1

3c3cdadf4a19973cf20c951373e8d98c51100e70
SHA256

9094f8e18f5e248b3fc2221af1f99eba1c32e5951a7c413e8dc4c1be5f5b00d4
SHA512

f728f7cbdb00b9e6f0ab3a7cca67a9f37bfb2fc1f7b2b36be02a626fc3692189cab37cdd964fbcc5fef4d34aa7e4ed3813d7b16cd60d842e80a5a8d82812f18a
SSDEEP

49152:h1OshM1Yt+xHzi4+FWFR6Yya1w6pFiPgXytcg:h1OwM0Gi4hR6YyECr

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  9094f8e18f5e248b3fc2221af1f99eba1c32e5951a7c413e8dc4c1be5f5b00d4
- Size
  
  2.1MB
- MD5
  
  d65241da727659af26d7b7ceb3ed8d9b
- SHA1
  
  3c3cdadf4a19973cf20c951373e8d98c51100e70
- SHA256
  
  9094f8e18f5e248b3fc2221af1f99eba1c32e5951a7c413e8dc4c1be5f5b00d4
- SHA512
  
  f728f7cbdb00b9e6f0ab3a7cca67a9f37bfb2fc1f7b2b36be02a626fc3692189cab37cdd964fbcc5fef4d34aa7e4ed3813d7b16cd60d842e80a5a8d82812f18a
- SSDEEP
  
  49152:h1OshM1Yt+xHzi4+FWFR6Yya1w6pFiPgXytcg:h1OwM0Gi4hR6YyECr
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer