6f1d5f511bd10b770a34b5d2f54014a423d9a87fd8d52458610458e583fab20f | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_f4c8e921387a871d2c8102ee353dc354
Size 634KB
Sample240204-pf8scsbcdm
SHA256 6f1d5f511bd10b770a34b5d2f54014a423d9a87fd8d52458610458e583fab20f
MD5 f4c8e921387a871d2c8102ee353dc354
SHA1 89ced0d772ae799eb165461b6059bdfe98faf3c0
SHA512 5cbbe344e0be02e0900261931329c8aafca9a9c127111b30301588dc203119562b34293c0d30aa97c455516b4eaba92a232ac3db84644adfa6d50a9b0072896c
SSDEEP 12288:XGMWgEG4GjeZHkwuPikQ7lKH5p5H9x1keZHkwuliXQTlKB5pixyiR+:XGeEG4GjeZEXi37l6Br1keZEdigTl26U
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_f4c8e921387a871d2c8102ee353dc354
- Size 634KB
- SHA256 6f1d5f511bd10b770a34b5d2f54014a423d9a87fd8d52458610458e583fab20f
- MD5 f4c8e921387a871d2c8102ee353dc354
- SHA1 89ced0d772ae799eb165461b6059bdfe98faf3c0
- SHA512 5cbbe344e0be02e0900261931329c8aafca9a9c127111b30301588dc203119562b34293c0d30aa97c455516b4eaba92a232ac3db84644adfa6d50a9b0072896c
- SSDEEP 12288:XGMWgEG4GjeZHkwuPikQ7lKH5p5H9x1keZHkwuliXQTlKB5pixyiR+:XGeEG4GjeZEXi37l6Br1keZEdigTl26U
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home3812chaction.js
- Size 834B
- SHA256 ac14fadee00c542f5eb6d1f3849262638d94d1fa7c46d66d2fd738ac5031c8b4
- MD5 6ae0d232c527354fcb58456bff71673f
- SHA1 23293781cc4ce7519e2759f63e4faf2d1c7782a9
- SHA512 bfd894be2d1666b73021052ea9ce5f534edbd195da30b13f93324fa06e080e09c4e27cd5be1fac772b300b444630b453f257271ffd29b083147575c9ae9fc1ac
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home3812.js
- Size 747B
- SHA256 937de954d2b4f58ca52e4be31086a15472f654cf20cd9eba8589a880d6b18f01
- MD5 f68e143cc5e4348a51bccc0edf99e4e5
- SHA1 2cf75c65a9f7fdbf662f56ac1a4df2709daabea7
- SHA512 c4eb1cce75fff5e47935cffc8f559e4ddfe93e5853c0c34b3c89dd0274ff4ccf5f9f75b0b91d1747b7b96c8aa77ab839e97e45333c587a63f0ed12262c8010a9
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home3812ffaction.js
- Size 678B
- SHA256 d0a9b2b34f0ce88be859136c83cc1506e87f38e496daa303e9a2fbab5753ea3a
- MD5 c859202efe4bc224cd7da2982d8aa702
- SHA1 5f1909f8859ebc2a5a2be58aa90332d690b6763b
- SHA512 e77c518b61e692af19da01ec280d8d18baf31b13d603115a47f9eef9a770f62b0f0b1a4b9beef81289660b750a56d5a99cb51a463670f698990bf9548378c5ae
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home3812.dll
- Size 85KB
- SHA256 7f9be0ab52e1a84fe0a8b704730500e2db0266553df5a2c68c571d21cd48e764
- MD5 dd2297881e37afedebb422552f1ebe45
- SHA1 c58de5a5e43bc8adb470a39881bdc48ec147765c
- SHA512 841d0c2953b8ca23563c5c06fdbad9cc71715bf8fa78162d17b7715ca26f2b47784707dbf02fafae62a5bd9a9638e474723443610cd492aa294f7e1241f22e42
- SSDEEP 1536:n8/1CsEmka04RhRtahrOb8DkhR6HA9glQf/Rh:g12mka0ElahrOF6guaf/R
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 2ee564ba76ea17ba336797246ecdf936ae2a562c58697207e06bd5ba535b821f
- MD5 d1e23f92e8bfbae7248ee3f9afeb2c00
- SHA1 29eba6deedd342ba7c8f2f2089f5974e400ec522
- SHA512 877ee5df6a8238798792d4509d88b3640bdb5b74f7b7893258a5cc58377b70aad01f6e6aa77a6eed09972c09e366c22e94fdff03d45f02227138752bc3bd1150
- SSDEEP 6144:Ee344IpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1Q:90eZHkwuPikQ7lKH5p5H9x1Q
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16