99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94 | Triage

Sharing

General

Target

99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94
Size

177KB
Sample

221206-3fc8cadh48
MD5

1e6054e7c0223d0c1508cbe1f7385be5
SHA1

81dd2d3672a77e30814cc0f2dc33b1060e36fea5
SHA256

99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94
SHA512

66b69db35b8d8a7fd500d46fcea38e714e5a33bb4947a091ec4b3d266707c578f7a468b1764e0a5b86a2045b86cd7e10572c4415c40ed070fa272da63c8649de
SSDEEP

3072:RWM9GVvfUoNkaCGaHz+BUVC6GrVM5OXAfVXbmeWcnb:cpVvfUyka4qBiLSVMIXANXbmeR

Score

7^/10

adware stealer

Malware Config

Targets

- Target
  
  99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94
- Size
  
  177KB
- MD5
  
  1e6054e7c0223d0c1508cbe1f7385be5
- SHA1
  
  81dd2d3672a77e30814cc0f2dc33b1060e36fea5
- SHA256
  
  99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94
- SHA512
  
  66b69db35b8d8a7fd500d46fcea38e714e5a33bb4947a091ec4b3d266707c578f7a468b1764e0a5b86a2045b86cd7e10572c4415c40ed070fa272da63c8649de
- SSDEEP
  
  3072:RWM9GVvfUoNkaCGaHz+BUVC6GrVM5OXAfVXbmeWcnb:cpVvfUyka4qBiLSVMIXANXbmeR
Score

7^/10

adware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2