e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035 | Triage

Sharing

General

Target

e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035
Size

1.4MB
Sample

221204-adbmhsdb8s
MD5

bef495809e1dd90ff241a27015ae59e0
SHA1

14f7157b558fb918f32d200b688c20b9b8b60225
SHA256

e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035
SHA512

e676610d18873332c2262d1bc0ad84fdc08fd777f28c11ebb99e3137e1977071fdb97a0e1fe89dba084fd0ceae66410152462477a860026a3e9c3b836a5cd3ae
SSDEEP

24576:n7/iW4aTva1MpL78F9qBhAo2ODgNEBOvVf7wj7+a6B51zY7tpstbQTSD9x:nLiMTlA4BAOEEwsj7aB/zqSbQ2

Score

10^/10

adware evasion persistence stealer trojan

Malware Config

Targets

- Target
  
  e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035
- Size
  
  1.4MB
- MD5
  
  bef495809e1dd90ff241a27015ae59e0
- SHA1
  
  14f7157b558fb918f32d200b688c20b9b8b60225
- SHA256
  
  e32cee32c8e79635235b3b23052782a8552b057bd18e989702f753b0d48de035
- SHA512
  
  e676610d18873332c2262d1bc0ad84fdc08fd777f28c11ebb99e3137e1977071fdb97a0e1fe89dba084fd0ceae66410152462477a860026a3e9c3b836a5cd3ae
- SSDEEP
  
  24576:n7/iW4aTva1MpL78F9qBhAo2ODgNEBOvVf7wj7+a6B51zY7tpstbQTSD9x:nLiMTlA4BAOEEwsj7aB/zqSbQ2
Score

10^/10

adware evasion persistence stealer trojan
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwareevasionpersistencestealertrojan

behavioral2