f77b3e553f492cb59d2a5d5c339b7b155631e806ba21ea6c74750f7b572dcce6 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_d281bd9d9369d3d3de5005b348a93e2b
Size 634KB
Sample240204-qdb62sace3
SHA256 f77b3e553f492cb59d2a5d5c339b7b155631e806ba21ea6c74750f7b572dcce6
MD5 d281bd9d9369d3d3de5005b348a93e2b
SHA1 c1dc879b42750867898d5b491a6b49053377b26b
SHA512 669c9db1eceb56c0de0c8063ff686bf616f3b7343e72a2777e3f8ce875835818dfc719617f57c9607f007c06a2b823807b086658cb0e5a2171030a818421e2d1
SSDEEP 12288:9BQhY1G4GjeZHkwuPikQ7lKH5p5H9x1oeZHkwulinQZlKR5pxxoiRU:9BQeG4GjeZEXi37l6Br1oeZE9iQZl2ps
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_d281bd9d9369d3d3de5005b348a93e2b
- Size 634KB
- SHA256 f77b3e553f492cb59d2a5d5c339b7b155631e806ba21ea6c74750f7b572dcce6
- MD5 d281bd9d9369d3d3de5005b348a93e2b
- SHA1 c1dc879b42750867898d5b491a6b49053377b26b
- SHA512 669c9db1eceb56c0de0c8063ff686bf616f3b7343e72a2777e3f8ce875835818dfc719617f57c9607f007c06a2b823807b086658cb0e5a2171030a818421e2d1
- SSDEEP 12288:9BQhY1G4GjeZHkwuPikQ7lKH5p5H9x1oeZHkwulinQZlKR5pxxoiRU:9BQeG4GjeZEXi37l6Br1oeZE9iQZl2ps
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home4857chaction.js
- Size 834B
- SHA256 0bd493fe0a0340c5d41c99104b0abdb5635cac3cb7fec64366f2522eb4957476
- MD5 8a338d1ae62b5fc88ca85a421e297b11
- SHA1 dc9886d36692658d10b3768d11d5ca72738db7bf
- SHA512 ecf6ff82cad4f6fdd3eb989fe152fe54b261fd847832e931c4f9e22b39400f0a0a76a97dab22eaa1f810632a33bd286e16e7cc5cd6d66611fd90264ad5b3f787
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home4857.js
- Size 747B
- SHA256 5b60a29240e2033d640975aa55a538aa3b483f7e95df5fa1bd27d7ae573cbfe7
- MD5 e368315eeac8297a098f280433ff4bd7
- SHA1 dbc6e889cce8a84e9c6626e42ef9f36b768884ef
- SHA512 b3790dc3bdf0872eaf0bd2b8ae361a7968f9ca8a2f55708246bca0ee8757916d3c79416c73f8c833ab1bcf1c7c4abf2accb2c9aac9e48723ccfdb63ac142139c
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home4857ffaction.js
- Size 678B
- SHA256 0ef0bc27f32a4d5e348eb35215797cd02b7c7715b1a12cccd47bfd743f79a7f9
- MD5 7007a877464abd4f81fc084db4b2e123
- SHA1 63c00b966ec7c60585046025e0723e74e5d0e333
- SHA512 942bc590efe59708ade962468ce6d8c6f44977497d93412af7fe6c48fbeb712501b6a3c58b1dc5c6840a39f4a10b0ade92a57349b9dc1206357427abba1bfbbb
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home4857.dll
- Size 85KB
- SHA256 e0f78d718bc0e078a95fe307ce2119f4a3c2d46a4dd3ed9640ed3ff0a92a3883
- MD5 12e4a4316303522fa979bf5ba4654fdb
- SHA1 c61e2ee4cf4801f9f9bcde69b2f9fc221ad79824
- SHA512 066b7c1fa90aced35cae38aca58620507c35488714d31b2fb288be45d7a02e86bfab1c302b92486c2c95c63f1cdea6fec76d3f151e8d245a588dd0b1e8417ab4
- SSDEEP 1536:X8/1CsEmka04RhRtahrOb8DkhRhHA9glQbDJynx:Q12mka0ElahrO9hguabDJyn
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 af751c8b13b1f81f2abce4c21f8910ae530a0a875e587577837db5ff51444004
- MD5 b8f1ad9be9af6250968167b3c460bacd
- SHA1 f8d0ef7451df6b484b5a64bd10377bb02bcabb08
- SHA512 30173a8bf75a539e2d88486fd41503a50f784a361de8e5db47c682048c2466e3a94b673d3998f30cf3781c5057991e003c3f1813ff643b21d9f19670f09c2677
- SSDEEP 6144:Ee34+yCtpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1I:H/eZHkwuPikQ7lKH5p5H9x1I
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16