fbdac75d7e1eeff6598b4498f8395f3adac68c343f1417073527edb6c575e900 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_1a10cf0b9987f4342f7ff20b1495ffe4
Size 657KB
Sample240204-qf6tfaade2
SHA256 fbdac75d7e1eeff6598b4498f8395f3adac68c343f1417073527edb6c575e900
MD5 1a10cf0b9987f4342f7ff20b1495ffe4
SHA1 72d1f737b16080150c7221047323592e0158f67c
SHA512 3163f51be6d26adf543c4cfc98dc831167f59a1d5c5be0e155adeb53de0de8c74a4f9cda05a05d5aa2538b28472d5b60e2b8312253cc29a404b0e597eb7afdea
SSDEEP 12288:a0Tb0wG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Boq4WarQTwJ8ePB/p5uO71U26eB+:aqYwG4GQm4OaHYJ8eP4D5uOHBBd4WaSR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_1a10cf0b9987f4342f7ff20b1495ffe4
- Size 657KB
- SHA256 fbdac75d7e1eeff6598b4498f8395f3adac68c343f1417073527edb6c575e900
- MD5 1a10cf0b9987f4342f7ff20b1495ffe4
- SHA1 72d1f737b16080150c7221047323592e0158f67c
- SHA512 3163f51be6d26adf543c4cfc98dc831167f59a1d5c5be0e155adeb53de0de8c74a4f9cda05a05d5aa2538b28472d5b60e2b8312253cc29a404b0e597eb7afdea
- SSDEEP 12288:a0Tb0wG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Boq4WarQTwJ8ePB/p5uO71U26eB+:aqYwG4GQm4OaHYJ8eP4D5uOHBBd4WaSR
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 567KB
- SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- MD5 450753ad96785a240a39deccab3af0d0
- SHA1 21c544064d2ffa6444508268ce258a330d459fc5
- SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffRichMediaViewV1release373chaction.js
- Size 859B
- SHA256 2fc9177a2db2f31c5b6aa516b59a975e736424affc8009819d03c9e40f0b2aef
- MD5 2beca6c23789ef853ff95d4e27fb2a5a
- SHA1 8dcfca391fda9f647f4f902bfacddc8b9ea50dc9
- SHA512 e0e5bba3df0d8022812070b7b4e28106a49627b6d60233a68ef399754939c5b1415a5537647ad68ee847cb45a1023068ecfea4b03a870fbac13c51a718f866fa
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffRichMediaViewV1release373.js
- Size 762B
- SHA256 569a72a4bf419c6a43e6b34d81045a18b67c6cd604e931992bd7ee03d00525d9
- MD5 5bc4d7069945a80ba063bf5dd826ff89
- SHA1 7e6da30a9e4e6d32d016b55eaabc4a3049fabe06
- SHA512 af324838c820b3d837a40abfc64cc46958aa6e7afd55a387835e3b50ef39e7726acc6d05cb3062158dde040e855d2cde8d629b6977ff4e0e9841d1a61bf5205b
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffRichMediaViewV1release373ffaction.js
- Size 698B
- SHA256 28aa27c68f758d21d78373efbcdc8276c1f599e2ae9ffa70f83e50946a0b59d3
- MD5 cc26623352bfd9478034dd896a11e531
- SHA1 ab12f0205ccbacff7bd1e424e105ff44e281fa35
- SHA512 4e1ff32dda9f87540984b9189453605e195a534d2ffa006664c37568271035cc3ff7ea78267729a29c8fb7784147f37ef9476019e2227bc38381b8225bd558ef
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/RichMediaViewV1release373.dll
- Size 85KB
- SHA256 2b0d829364f051a60d45ced2d6a78b7805469e4dea657c9364fde8164d91b499
- MD5 8a8ad890a135a3418283374dfbeabcf8
- SHA1 7ad3d85e822a56fff035181d7781345df8b314cd
- SHA512 daa5713ff486c16b17ee7e714f9955bc0b6bc43bed56f71b869fc3ed4d194e9409ea7e8e6f9e698c0a8b31c0900e6f8778ceeecf20d05674057c4ab1b0d34374
- SSDEEP 1536:Xkf9Csc+EE7Msd5N60GlVk8jkrwvNnqLhPLlQgVDdBZ:49++EEwsJ6FlVvNnmagVDt
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 289KB
- SHA256 9372aeff962ad6c69df8f6775b46b85302de99b91896a2544795038d605e4b02
- MD5 566f254a5b3a10f66f20cc4049cb67a7
- SHA1 5bb8fea73edbce4d1feaced7dee122fbed000313
- SHA512 f5ba513532946751a247870965fa2252cc6bae357c4781b0cec670bcedd5751fb867d6e29763c008e6e482b12d914556c08e7a769a6f92a0738d8eabbaca410a
- SSDEEP 6144:Ue34Z3Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmJ:03q4OaQQTYJ8eP4/L5uO7D3f5BQ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 567KB
- SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- MD5 450753ad96785a240a39deccab3af0d0
- SHA1 21c544064d2ffa6444508268ce258a330d459fc5
- SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16