c307c6aec7c2f739a226e79f5713d5ca33d3b6ce089f72634b437e10382fbd5a | Triage

Sharing

General

Target

c307c6aec7c2f739a226e79f5713d5ca33d3b6ce089f72634b437e10382fbd5a
Size

2.1MB
Sample

221125-yt3myaeh2v
MD5

3ae1fed9e64e6226a0133fdfbb496984
SHA1

9743e5797a7bf949a06c2e6803eb1145f24f9cf0
SHA256

c307c6aec7c2f739a226e79f5713d5ca33d3b6ce089f72634b437e10382fbd5a
SHA512

4e0247d97c118aaad151d3aa07252416990e7a84af1d2431248b3d40bd7b168a4750ef2e810de19f8732db1429fed27f8d1cabac4be6b0d0dbbaaf7f6afcbf64
SSDEEP

49152:h1OsjBNPM6n5oHCZdw3CyvHht6wqM7M1cHp:h1OUBjn5oHCZMDvHhrqMMi

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  c307c6aec7c2f739a226e79f5713d5ca33d3b6ce089f72634b437e10382fbd5a
- Size
  
  2.1MB
- MD5
  
  3ae1fed9e64e6226a0133fdfbb496984
- SHA1
  
  9743e5797a7bf949a06c2e6803eb1145f24f9cf0
- SHA256
  
  c307c6aec7c2f739a226e79f5713d5ca33d3b6ce089f72634b437e10382fbd5a
- SHA512
  
  4e0247d97c118aaad151d3aa07252416990e7a84af1d2431248b3d40bd7b168a4750ef2e810de19f8732db1429fed27f8d1cabac4be6b0d0dbbaaf7f6afcbf64
- SSDEEP
  
  49152:h1OsjBNPM6n5oHCZdw3CyvHht6wqM7M1cHp:h1OUBjn5oHCZMDvHhrqMMi
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer