49ddb0e8872ab346c4ae61037c04b883e2fdf11ab980b810ed2fc5fa4875449e | Triage

Sharing

General

Target

49ddb0e8872ab346c4ae61037c04b883e2fdf11ab980b810ed2fc5fa4875449e
Size

2.5MB
Sample

221125-cc2tesdd45
MD5

7d1db19ed5d48e5f3889f7e76497b25e
SHA1

13322199c744ac904e0dc68e64b5217c06431b2e
SHA256

49ddb0e8872ab346c4ae61037c04b883e2fdf11ab980b810ed2fc5fa4875449e
SHA512

a63e28beb32c4606cb5281a85db9af306c6e2555c9593be85175f258e33a61b01d9f1701da37cc0178388b16cbc3c14338d9f6574600dd3d0168ee2ad20a7899
SSDEEP

49152:h1OsVqvM+1ElFFRESBd6v89RbNezR1WnUKHhIY6aEBR5BT:h1O0qvMWElHxgv8NkRd

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  49ddb0e8872ab346c4ae61037c04b883e2fdf11ab980b810ed2fc5fa4875449e
- Size
  
  2.5MB
- MD5
  
  7d1db19ed5d48e5f3889f7e76497b25e
- SHA1
  
  13322199c744ac904e0dc68e64b5217c06431b2e
- SHA256
  
  49ddb0e8872ab346c4ae61037c04b883e2fdf11ab980b810ed2fc5fa4875449e
- SHA512
  
  a63e28beb32c4606cb5281a85db9af306c6e2555c9593be85175f258e33a61b01d9f1701da37cc0178388b16cbc3c14338d9f6574600dd3d0168ee2ad20a7899
- SSDEEP
  
  49152:h1OsVqvM+1ElFFRESBd6v89RbNezR1WnUKHhIY6aEBR5BT:h1O0qvMWElHxgv8NkRd
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer