fd25ba25c32afbe03b5f9901161c1a2037faada5899ed874bb08245a886dff56 | Triage

Sharing

General

Target

fd25ba25c32afbe03b5f9901161c1a2037faada5899ed874bb08245a886dff56
Size

2.5MB
Sample

221127-2hznpahe4s
MD5

3b4d30e86474a305130102b4a5236d08
SHA1

70bd102f60e489958ac10ffeac8a27c963e77d67
SHA256

fd25ba25c32afbe03b5f9901161c1a2037faada5899ed874bb08245a886dff56
SHA512

b49844cd478ffb92d38a697bc1b0cdb55f2f05ef4f99ac43eff4fdfa6a0b75399643d60b8fa2d643144f0aed7c23b80a68d96d9575316b5ce748167084adb75b
SSDEEP

49152:h1OscxNHPhw+gUPu1hTyleJDaSZulHdZAYokFKJr3CJROg:h1O7D5EPhelwlCJ0g

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  fd25ba25c32afbe03b5f9901161c1a2037faada5899ed874bb08245a886dff56
- Size
  
  2.5MB
- MD5
  
  3b4d30e86474a305130102b4a5236d08
- SHA1
  
  70bd102f60e489958ac10ffeac8a27c963e77d67
- SHA256
  
  fd25ba25c32afbe03b5f9901161c1a2037faada5899ed874bb08245a886dff56
- SHA512
  
  b49844cd478ffb92d38a697bc1b0cdb55f2f05ef4f99ac43eff4fdfa6a0b75399643d60b8fa2d643144f0aed7c23b80a68d96d9575316b5ce748167084adb75b
- SSDEEP
  
  49152:h1OscxNHPhw+gUPu1hTyleJDaSZulHdZAYokFKJr3CJROg:h1O7D5EPhelwlCJ0g
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer