a0cd2e6b45e3aa285dbdffd68929ae7333dcde44745c2c31eba38ebb4f58f320 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_5d9a495901c4c900025931446b58f87b
Size 657KB
Sample240204-pg7axshad2
SHA256 a0cd2e6b45e3aa285dbdffd68929ae7333dcde44745c2c31eba38ebb4f58f320
MD5 5d9a495901c4c900025931446b58f87b
SHA1 a38420bd377ef7d5aba9d89b7fb5c7b7c53f9bd2
SHA512 d83e9cc26c0e09b0b5f9c93322d08705ad5059a6144021ee28004e29b6e0886d581bf222df2565230bb7113c7801684de5fa2de52e05f03c2461b487da034877
SSDEEP 12288:t1a39cOG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BZq4yaPQTMJ8ePB/x5uO7jU26nm:t1cGOG4GQm4OaHYJ8eP4D5uOHBBc4yap
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_5d9a495901c4c900025931446b58f87b
- Size 657KB
- SHA256 a0cd2e6b45e3aa285dbdffd68929ae7333dcde44745c2c31eba38ebb4f58f320
- MD5 5d9a495901c4c900025931446b58f87b
- SHA1 a38420bd377ef7d5aba9d89b7fb5c7b7c53f9bd2
- SHA512 d83e9cc26c0e09b0b5f9c93322d08705ad5059a6144021ee28004e29b6e0886d581bf222df2565230bb7113c7801684de5fa2de52e05f03c2461b487da034877
- SSDEEP 12288:t1a39cOG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BZq4yaPQTMJ8ePB/x5uO7jU26nm:t1cGOG4GQm4OaHYJ8eP4D5uOHBBc4yap
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 567KB
- SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- MD5 450753ad96785a240a39deccab3af0d0
- SHA1 21c544064d2ffa6444508268ce258a330d459fc5
- SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffRichMediaViewV1release1019chaction.js
- Size 864B
- SHA256 bcaa725fd64adb1678271a9b0b3973e0c40b187cfadd124fc723219c4784e6f4
- MD5 deb129749ef4008fe313b7aa7a5bbf40
- SHA1 1a56e792a9ed5fb7437a42d7d751e5061484c083
- SHA512 b15323e6d658be426eea0c7856a8707def244bdc2b19fb6987d39931bb6fdac161b720b72d77fbf76a7e5ea7e04c25bd82516c77776c9135a726135d636fea6e
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffRichMediaViewV1release1019.js
- Size 765B
- SHA256 335ac7e95dab32c8e6fa6abd2b08f40d5efd629e30094fe6af5aea894c6e6225
- MD5 ee1885aabb4d31a3e482a1576f1d8244
- SHA1 7ec166d421b984682ba0449875176e1a5bd64b63
- SHA512 e1e941f1daff7f69286cea742d3699604fd091840ce781490dea51eb352c010f88dd60f29f23785635ff0ed37d3d806fa677666f0e85b0f9442a3567a8752487
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffRichMediaViewV1release1019ffaction.js
- Size 702B
- SHA256 336a8ad3476c408afdf97c20ab38854ae30b9819ac063d91e309ebd401ed122f
- MD5 1ecf0b0ec1a51a9eb6d34ab7765af440
- SHA1 9e1415b0c98ebbd7cba8bb32829eae3078f8505c
- SHA512 726c1f99d762b8a7e1f2d47e5b24267b3a346273b4ecde67ff8d0770416d45c9970ffd7551f3eac5d806e79914b2b89ba12cbe4b92ea35042ceb61290fcbee6c
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/RichMediaViewV1release1019.dll
- Size 85KB
- SHA256 8864a45c59dda713ee4544ee7f6da7a943111dfabf9ac5b519e74865b1b57d50
- MD5 5fdf75577c47ff3c12b3039241e6cf47
- SHA1 28cd7c96112fcff793b320039a212f74e18a83aa
- SHA512 84c90f22bb9f97b586f37ef7f97f495cdcb493234428c869752e4c04ba892ca6235bdd9e16b3a4873b810023f9474eb5d6835766de50daf3d417a151e63a49a3
- SSDEEP 1536:mRsmScYsswPVt6Ap1ZcTkLCzcCjfLlQdo13:jm6sswPn6Ap1Qcwado13
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 289KB
- SHA256 24e5d5ab13231f60be2e78406394296a50bd6bb9c90cb31078466f75efa62bcb
- MD5 48585aec63a8da5cd4ab915fe9f04a2d
- SHA1 bc288b5fd94d957f08b591c9a53059ba2e3a759a
- SHA512 f2d2bcb766dc346e78d9f2350c57845d8932d632206e7edd91bdcdd21e229e56c693ac3d8bb5740ed1957a3cc02582395cb20b2ef0f065c250830abb6fc11eed
- SSDEEP 6144:Ue34+YRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmy:nYq4OaQQTYJ8eP4/L5uO7D3f5BP
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 567KB
- SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- MD5 450753ad96785a240a39deccab3af0d0
- SHA1 21c544064d2ffa6444508268ce258a330d459fc5
- SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16