f82047f5ec70e96d8b8e1282b405eb088a55f3f3897ce8c7ba2bee76021ea801 | Triage

Sharing

General

Target

f82047f5ec70e96d8b8e1282b405eb088a55f3f3897ce8c7ba2bee76021ea801
Size

3.6MB
Sample

221125-hh292acd6t
MD5

59440c48cc573c6007f0921b8eef9118
SHA1

3fc0ca06d751f56bc007779a50fdd0777ce0fef6
SHA256

f82047f5ec70e96d8b8e1282b405eb088a55f3f3897ce8c7ba2bee76021ea801
SHA512

ba97f28acca428833ecf898154d669e4a4da39eff1690b656efeb9ce3a4eed64756188aabd983f8cbbe24ee7819dbab329734769c34c8ec5ab0eb4976b5dc15f
SSDEEP

49152:VvECBfqmsZdf1DB42bOrtMtunHmKty84AN6ukGervBldkzBjE/TCmso7L:V5fY1y2artMtunHmKtVfN6uj6DdkzGP

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  f82047f5ec70e96d8b8e1282b405eb088a55f3f3897ce8c7ba2bee76021ea801
- Size
  
  3.6MB
- MD5
  
  59440c48cc573c6007f0921b8eef9118
- SHA1
  
  3fc0ca06d751f56bc007779a50fdd0777ce0fef6
- SHA256
  
  f82047f5ec70e96d8b8e1282b405eb088a55f3f3897ce8c7ba2bee76021ea801
- SHA512
  
  ba97f28acca428833ecf898154d669e4a4da39eff1690b656efeb9ce3a4eed64756188aabd983f8cbbe24ee7819dbab329734769c34c8ec5ab0eb4976b5dc15f
- SSDEEP
  
  49152:VvECBfqmsZdf1DB42bOrtMtunHmKty84AN6ukGervBldkzBjE/TCmso7L:V5fY1y2artMtunHmKtVfN6uj6DdkzGP
Score

8^/10

adware discovery persistence spyware stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer