229b5ef754cd25f0971a8d8f1619c98801f015b439d2269d3d0792f6861740d3 | Triage

Sharing

General

Target

229b5ef754cd25f0971a8d8f1619c98801f015b439d2269d3d0792f6861740d3
Size

4.4MB
Sample

221125-ef6ynadd2x
MD5

145d1f84568f6b79316ae21049bfe840
SHA1

b3a629425c3874ec2576937bd6e6cb84d212af18
SHA256

229b5ef754cd25f0971a8d8f1619c98801f015b439d2269d3d0792f6861740d3
SHA512

8a0b4fb2d126244f4cdf304b1d33003aedd5a66ea77d1083c5e958aa031453bf1974bdae82ef756f9abf0b6fa5af647e688c03b204f3d0fbc607f0f32e9f45f3
SSDEEP

49152:E92KqaToIhG9URpUxup4Q4hXOjKzuFYdkX7PXGIjQslyoC3yE/Ac5mWxnm7x:uBTo56R9yOjK9kX7P2iQsAoWNAxenA

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  229b5ef754cd25f0971a8d8f1619c98801f015b439d2269d3d0792f6861740d3
- Size
  
  4.4MB
- MD5
  
  145d1f84568f6b79316ae21049bfe840
- SHA1
  
  b3a629425c3874ec2576937bd6e6cb84d212af18
- SHA256
  
  229b5ef754cd25f0971a8d8f1619c98801f015b439d2269d3d0792f6861740d3
- SHA512
  
  8a0b4fb2d126244f4cdf304b1d33003aedd5a66ea77d1083c5e958aa031453bf1974bdae82ef756f9abf0b6fa5af647e688c03b204f3d0fbc607f0f32e9f45f3
- SSDEEP
  
  49152:E92KqaToIhG9URpUxup4Q4hXOjKzuFYdkX7PXGIjQslyoC3yE/Ac5mWxnm7x:uBTo56R9yOjK9kX7P2iQsAoWNAxenA
Score

8^/10

adware discovery persistence spyware stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer