2a5fc40f055118d4d51942a15f6d53bc4d6f11781f97f5d5ec96a2e2546fef8d | Triage

Sharing

General

Target

2a5fc40f055118d4d51942a15f6d53bc4d6f11781f97f5d5ec96a2e2546fef8d
Size

2.1MB
Sample

221125-d2mapscd2z
MD5

e5effd8912fe4f9840da1e853f42d8f0
SHA1

b78f51bcb68a38b6b6c4ec1d444a38d8fe61125b
SHA256

2a5fc40f055118d4d51942a15f6d53bc4d6f11781f97f5d5ec96a2e2546fef8d
SHA512

c3daf6b05af7fb2a17a76475d65c534d0b670fea27cf561e2f2b91569ab3d3947f50d2929d91fa001318f9ba1d5760f555f4165da43b1c14f3543af3b4c486fd
SSDEEP

49152:EoGJzjpzE3iqXD3aQDJLPSiffStg6XLNNNIq+9yCy2rC6GpSq3Ij2tm:ES5XD3FZSiHeb3NQoCy2rrGZ1m

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2a5fc40f055118d4d51942a15f6d53bc4d6f11781f97f5d5ec96a2e2546fef8d
- Size
  
  2.1MB
- MD5
  
  e5effd8912fe4f9840da1e853f42d8f0
- SHA1
  
  b78f51bcb68a38b6b6c4ec1d444a38d8fe61125b
- SHA256
  
  2a5fc40f055118d4d51942a15f6d53bc4d6f11781f97f5d5ec96a2e2546fef8d
- SHA512
  
  c3daf6b05af7fb2a17a76475d65c534d0b670fea27cf561e2f2b91569ab3d3947f50d2929d91fa001318f9ba1d5760f555f4165da43b1c14f3543af3b4c486fd
- SSDEEP
  
  49152:EoGJzjpzE3iqXD3aQDJLPSiffStg6XLNNNIq+9yCy2rC6GpSq3Ij2tm:ES5XD3FZSiHeb3NQoCy2rrGZ1m
Score

8^/10

adware discovery persistence spyware stealer
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer