b3cf5006a3ca7577a38bf4a164efa3820d4926a96955d79a10b627f289417401 | Triage

Sharing

General

Target

b3cf5006a3ca7577a38bf4a164efa3820d4926a96955d79a10b627f289417401
Size

396KB
Sample

221204-kmarpagf4y
MD5

997b9b57c40edbb20fa1aa667a16bdf8
SHA1

06dda4c3ddd019e2362e3b3cbbcbbb1ad4d07c82
SHA256

b3cf5006a3ca7577a38bf4a164efa3820d4926a96955d79a10b627f289417401
SHA512

6addda6c56a1be81db18e4a98828400b9fbe9cc5b776caafdf7ce461185b90fdff6ed860e6efcca07a08f792b138dfc9c41687313bfa0193b4706b6009eaf07c
SSDEEP

3072:KAPrsC+8uGMHsRJNoAcrAsjQHMqpoHzS+IlJnkdCaKIXXCZziIYjM6Zq8UNL3teL:Rx+8uGMHsRYAJHvGhDLhw1qvSYeMCo9

Score

10^/10

adware evasion stealer

Malware Config

Targets

- Target
  
  b3cf5006a3ca7577a38bf4a164efa3820d4926a96955d79a10b627f289417401
- Size
  
  396KB
- MD5
  
  997b9b57c40edbb20fa1aa667a16bdf8
- SHA1
  
  06dda4c3ddd019e2362e3b3cbbcbbb1ad4d07c82
- SHA256
  
  b3cf5006a3ca7577a38bf4a164efa3820d4926a96955d79a10b627f289417401
- SHA512
  
  6addda6c56a1be81db18e4a98828400b9fbe9cc5b776caafdf7ce461185b90fdff6ed860e6efcca07a08f792b138dfc9c41687313bfa0193b4706b6009eaf07c
- SSDEEP
  
  3072:KAPrsC+8uGMHsRJNoAcrAsjQHMqpoHzS+IlJnkdCaKIXXCZziIYjM6Zq8UNL3teL:Rx+8uGMHsRYAJHvGhDLhw1qvSYeMCo9
Score

10^/10

adware evasion stealer
- Modifies firewall policy service
  evasion
- Deletes itself
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwareevasionstealer

behavioral2

adwareevasionstealer