b45be767bfcf5d2f034029069499318ac9bb1e5481b711676029a48d55289f0c | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_e8f35f3511618cf0d57d81d44e3d203c
Size 634KB
Sample240204-p98dpacdck
SHA256 b45be767bfcf5d2f034029069499318ac9bb1e5481b711676029a48d55289f0c
MD5 e8f35f3511618cf0d57d81d44e3d203c
SHA1 03ef45d894934cb0dec4cd28de5dda2401d07472
SHA512 a0092a1db39ce3189f33df5a6a8b644519969c103ba9444bb4401dafc261b39b5d7e4db4d82455a497f11e889b7490655988de68f58d305c3a00aed944f47a4d
SSDEEP 12288:bkwIG4GjeZHkwuPikQ7lKH5p5H9x1KeZHkwu9itQplKd5pyxllfJ:bkwIG4GjeZEXi37l6Br1KeZE1iCplOqX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_e8f35f3511618cf0d57d81d44e3d203c
- Size 634KB
- SHA256 b45be767bfcf5d2f034029069499318ac9bb1e5481b711676029a48d55289f0c
- MD5 e8f35f3511618cf0d57d81d44e3d203c
- SHA1 03ef45d894934cb0dec4cd28de5dda2401d07472
- SHA512 a0092a1db39ce3189f33df5a6a8b644519969c103ba9444bb4401dafc261b39b5d7e4db4d82455a497f11e889b7490655988de68f58d305c3a00aed944f47a4d
- SSDEEP 12288:bkwIG4GjeZHkwuPikQ7lKH5p5H9x1KeZHkwu9itQplKd5pyxllfJ:bkwIG4GjeZEXi37l6Br1KeZE1iCplOqX
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home4176chaction.js
- Size 834B
- SHA256 3de7b3e4a1aa3a530a21e85670be5d6d77b4e902e8323b65923c756209de8a17
- MD5 a0fd126e8857d633e866e6bac102aceb
- SHA1 94b9b4c5e8a64049b09112ad6958d315e7e8d14e
- SHA512 d77375d6b83b6edc71204b29157d2f918d4b842150a3068a208324778e096622c2c1aa68369414f4c3fe997f33efe2f07b7aeb0cbe4c23fd92eb5e876bc99613
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home4176.js
- Size 747B
- SHA256 cbc11c7599bed98b70782c645a02e6cf06585518b9579a43c405fab1fd95d89b
- MD5 42729f2e7c03b2973adbed68f6bd50f2
- SHA1 71697ba52fd0eed380a5ee3a1cdb1611a4a25a75
- SHA512 ab40f9f20eea21553f6c684390f234b07169c5815ff891e2949dffe86be593f098d4d20efab1e1dd7aeeac51b2fa8f0354c25dd876a1873eadfc621ab2ab41f6
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home4176ffaction.js
- Size 678B
- SHA256 830358e2a3dddc1b4f3b8395b2d7d0684c6470340b1f1cdf4cba91ea87f16688
- MD5 c04384985a2d80fe2220e1adfb1822dc
- SHA1 830cb937ceacd16a06068f11e9e091fe6c7a0547
- SHA512 0265d16e0ed9c0bd8b0fa8a06861a872496955f4f7bece2b0ad799d8940a6a6c2ea648883795c38030bf06b9343ef341b20b5e8daa90ffaa20a31f175366c277
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home4176.dll
- Size 85KB
- SHA256 6e0c5a1a43686acbd5622bb18877fad75cbc63866b0070582e771f1aca9b439f
- MD5 ea98c9ab7326e558f2ae92bf642d0796
- SHA1 0e8afc35c37ef5e0de609398ffcf476935468be2
- SHA512 b412754b5d77f7620df0bdc66cfeeb114399505b4011e2c4eb7c4b195d1676ca7769768f745f8ce8354e2ccac41268ee1a5673c7129802eab38e2d3c14d615b7
- SSDEEP 1536:mMflScQkG04RfxtakrOb8DkxKRHgNglQOuW:RlikG0ELakrOaRA+aOuW
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 99b82c8a72bd81863ca7e31d462d8d7678ad7b03d9699e229af82ef374881b23
- MD5 106086ee11833f12c9acee08c2f4a5f1
- SHA1 33aa239e7fc2617677de60525e5f3eb9c51c733a
- SHA512 56463c30185f9482ecf2d60ce83279890585cb878c4ccd5f13b9cd5e8b56643b3574b270ce1395b887a2496ddc6fbc7f5dc77ef4d6d95903e6fa5727ac116c2e
- SSDEEP 6144:Ee348CpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1o:5ieZHkwuPikQ7lKH5p5H9x1o
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16