12dcee1368a36aa3e991f9607061dfeee64c11558f13283d39d61c7c4600eed2 | Triage

Sharing

General

Target

12dcee1368a36aa3e991f9607061dfeee64c11558f13283d39d61c7c4600eed2
Size

4.4MB
Sample

221125-fdt2raca94
MD5

44e69067cd8e63e83ef4752f00477cfa
SHA1

d2e6459e2b1de75d696dc84f75de0e1ee8017b8f
SHA256

12dcee1368a36aa3e991f9607061dfeee64c11558f13283d39d61c7c4600eed2
SHA512

633b7e01e57d5d3dcaec034fa257f02b70883d5eba2da07ef7e17361d365f101b1862bbb96d2d9e4a354e41568d28a470129b4bbe1c5f34dea7c2a8077d2038c
SSDEEP

49152:kqk09VB9O6uUkK6Dmxup42ppWmD/M2BKQlGPXGIjQnjSlM/Zf0weeDNx2y:D/POIB6Rpp1D/wP2iQnj8MNtLNx2

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  12dcee1368a36aa3e991f9607061dfeee64c11558f13283d39d61c7c4600eed2
- Size
  
  4.4MB
- MD5
  
  44e69067cd8e63e83ef4752f00477cfa
- SHA1
  
  d2e6459e2b1de75d696dc84f75de0e1ee8017b8f
- SHA256
  
  12dcee1368a36aa3e991f9607061dfeee64c11558f13283d39d61c7c4600eed2
- SHA512
  
  633b7e01e57d5d3dcaec034fa257f02b70883d5eba2da07ef7e17361d365f101b1862bbb96d2d9e4a354e41568d28a470129b4bbe1c5f34dea7c2a8077d2038c
- SSDEEP
  
  49152:kqk09VB9O6uUkK6Dmxup42ppWmD/M2BKQlGPXGIjQnjSlM/Zf0weeDNx2y:D/POIB6Rpp1D/wP2iQnj8MNtLNx2
Score

8^/10

adware discovery persistence spyware stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer