79eba95155306bb40322960e71813d3e073f56dd427857ef2bd0985b6b15f733 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e228a6ae12748e92fad02d2f32b41da
Size

108KB
Sample

231225-1k3mpagdf4
MD5

3e228a6ae12748e92fad02d2f32b41da
SHA1

c908a9b3f11a09931883d7725aaf6ee0764696c2
SHA256

79eba95155306bb40322960e71813d3e073f56dd427857ef2bd0985b6b15f733
SHA512

88088c7f8279d0a05e898e5aff9f369a563c08c6ed36c56af1581cac4da8a79be405e6829015f789795bf124ec487ac3904646aea6aafb6cf106e0db296df69b
SSDEEP

1536:cXoahnLiXUnpncVZRoOvnpKZb+1dG4ZsfLKBFbfcOOT8bTnNhsnXRQ:xUQwnc/RoOxKN+1dG6sLCF4OmmTNhi

Score

7^/10

adware evasion persistence stealer trojan

Malware Config

Targets

- Target
  
  3e228a6ae12748e92fad02d2f32b41da
- Size
  
  108KB
- MD5
  
  3e228a6ae12748e92fad02d2f32b41da
- SHA1
  
  c908a9b3f11a09931883d7725aaf6ee0764696c2
- SHA256
  
  79eba95155306bb40322960e71813d3e073f56dd427857ef2bd0985b6b15f733
- SHA512
  
  88088c7f8279d0a05e898e5aff9f369a563c08c6ed36c56af1581cac4da8a79be405e6829015f789795bf124ec487ac3904646aea6aafb6cf106e0db296df69b
- SSDEEP
  
  1536:cXoahnLiXUnpncVZRoOvnpKZb+1dG4ZsfLKBFbfcOOT8bTnNhsnXRQ:xUQwnc/RoOxKN+1dG6sLCF4OmmTNhi
Score

7^/10

adware evasion persistence stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwareevasionpersistencestealertrojan

behavioral2

adwareevasionpersistencestealertrojan