a5204e22b2f16f6bc677fc651a581c40cab5b4d5539255b3bb8cad074876e062 | Triage

Sharing

General

Target

a5204e22b2f16f6bc677fc651a581c40cab5b4d5539255b3bb8cad074876e062
Size

2.1MB
Sample

221125-ywmz9scb32
MD5

ccf3ccada284c70b7edf84376038ac2a
SHA1

8df8e4751ad17b92226fe679bb310cdd2ca5adf4
SHA256

a5204e22b2f16f6bc677fc651a581c40cab5b4d5539255b3bb8cad074876e062
SHA512

02ab711cadaa8b3e7858a3b54e4a1d031abf86897ecf7a444d80a2a7dd25ff69560cb733f384418d5f364d6aea793f03a112fa34c0b799289166e2b74c15248e
SSDEEP

24576:h1OYdaOgzoi5Fm2qmA+L4zKWQt0moNdqNFSj8y0j9jtaJB5ZuUUr2YGnEQ/VfVL:h1OsqmLmVJWQt0mozqW78bSVfVL

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  a5204e22b2f16f6bc677fc651a581c40cab5b4d5539255b3bb8cad074876e062
- Size
  
  2.1MB
- MD5
  
  ccf3ccada284c70b7edf84376038ac2a
- SHA1
  
  8df8e4751ad17b92226fe679bb310cdd2ca5adf4
- SHA256
  
  a5204e22b2f16f6bc677fc651a581c40cab5b4d5539255b3bb8cad074876e062
- SHA512
  
  02ab711cadaa8b3e7858a3b54e4a1d031abf86897ecf7a444d80a2a7dd25ff69560cb733f384418d5f364d6aea793f03a112fa34c0b799289166e2b74c15248e
- SSDEEP
  
  24576:h1OYdaOgzoi5Fm2qmA+L4zKWQt0moNdqNFSj8y0j9jtaJB5ZuUUr2YGnEQ/VfVL:h1OsqmLmVJWQt0mozqW78bSVfVL
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer