7161d0b4a22cc2fb982eaefef37b60d0a8d3754df47bf6b834ade1a8de66a1c7 | Triage

Sharing

General

Target

7161d0b4a22cc2fb982eaefef37b60d0a8d3754df47bf6b834ade1a8de66a1c7
Size

3.7MB
Sample

221125-jh8bqabe94
MD5

c6d4b7c87c5054287f8b013b52efcc70
SHA1

a890f74f0d1b841bc8c7e3b852a969e59953e29a
SHA256

7161d0b4a22cc2fb982eaefef37b60d0a8d3754df47bf6b834ade1a8de66a1c7
SHA512

9ac16d9f828be1c263c8782d6ecbf91bb80f6ee5b3f9f32912ba171c31f3db62096201971eb85328c1afd9f5f51dc5cc5ba23927792158cabf31770efdc13842
SSDEEP

98304:Biwqc1QOmgr95lruchODV02e752KRLafiiz3fXPsxJ0ZC/LHzE:Iwqc1QOmgr95lruchODV02e92KRLaNsK

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  7161d0b4a22cc2fb982eaefef37b60d0a8d3754df47bf6b834ade1a8de66a1c7
- Size
  
  3.7MB
- MD5
  
  c6d4b7c87c5054287f8b013b52efcc70
- SHA1
  
  a890f74f0d1b841bc8c7e3b852a969e59953e29a
- SHA256
  
  7161d0b4a22cc2fb982eaefef37b60d0a8d3754df47bf6b834ade1a8de66a1c7
- SHA512
  
  9ac16d9f828be1c263c8782d6ecbf91bb80f6ee5b3f9f32912ba171c31f3db62096201971eb85328c1afd9f5f51dc5cc5ba23927792158cabf31770efdc13842
- SSDEEP
  
  98304:Biwqc1QOmgr95lruchODV02e752KRLafiiz3fXPsxJ0ZC/LHzE:Iwqc1QOmgr95lruchODV02e92KRLaNsK
Score

8^/10

adware discovery persistence spyware stealer
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer