49805622746096f1bae1a082117dab1eaec663d96ca6544516ed2f97e68821af | Triage

Sharing

General

Target

49805622746096f1bae1a082117dab1eaec663d96ca6544516ed2f97e68821af
Size

2.0MB
Sample

221127-g4lzhaad6t
MD5

188bc7fa42cd843513cf50553e73b942
SHA1

ab20746f61949c3cd9b9362326272cfeae7a2f88
SHA256

49805622746096f1bae1a082117dab1eaec663d96ca6544516ed2f97e68821af
SHA512

19c1bbbf93d406a27895863a58ed3009388e23ed97e7329de6d6c8ff2b68bcf9c362e271f22cf5cdc7a01b28903868e13a8f63bdae61a09ca42cf732c21c6b84
SSDEEP

49152:h1OslNQToNVxbNrInKtDSwSm7CXH9e7B6cr7J30Ct40pTK:h1OUNQUNVxNpSmGXMvxdt2

Score

8^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  49805622746096f1bae1a082117dab1eaec663d96ca6544516ed2f97e68821af
- Size
  
  2.0MB
- MD5
  
  188bc7fa42cd843513cf50553e73b942
- SHA1
  
  ab20746f61949c3cd9b9362326272cfeae7a2f88
- SHA256
  
  49805622746096f1bae1a082117dab1eaec663d96ca6544516ed2f97e68821af
- SHA512
  
  19c1bbbf93d406a27895863a58ed3009388e23ed97e7329de6d6c8ff2b68bcf9c362e271f22cf5cdc7a01b28903868e13a8f63bdae61a09ca42cf732c21c6b84
- SSDEEP
  
  49152:h1OslNQToNVxbNrInKtDSwSm7CXH9e7B6cr7J30Ct40pTK:h1OUNQUNVxNpSmGXMvxdt2
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer