Overview

overview

7

Static

static

3

VirusShare...8f.exe

windows7-x64

7

VirusShare...8f.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

ffRichMedi...ion.js

windows7-x64

1

ffRichMedi...ion.js

windows10-2004-x64

1

ff/chrome/...757.js

windows7-x64

1

ff/chrome/...757.js

windows10-2004-x64

1

ff/chrome/...ion.js

windows7-x64

1

ff/chrome/...ion.js

windows10-2004-x64

1

ie/RichMed...57.dll

windows7-x64

6

ie/RichMed...57.dll

windows10-2004-x64

6

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_98a9df22205600f9687c7d7c28ba208f

  • Size

    657KB

  • Sample

    240204-s7qbwaddd5

  • MD5

    98a9df22205600f9687c7d7c28ba208f

  • SHA1

    c8163b051ab22fc9571681ad8605f3c7e356240e

  • SHA256

    e5a0cbed2e9fea774407469a6d122b44fd311fae59febc5a3c21634d03033b18

  • SHA512

    657cc982521a533af4219acead2c44cfa7a91d41bc12606c9213d030ef65c43535ddc6263116d7c317cfa08b8c7ba39de339e27710d979b0256c6ef8cd7890ec

  • SSDEEP

    12288:fMQblG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BUq4kaBQTcJ8ePx/r5uO7zU26OB8:fMMlG4GQm4OaHYJ8eP4D5uOHBBJ4kawr

Score
7/10
adwarediscoveryspywarestealer

Malware Config

Targets

    • Target

      VirusShare_98a9df22205600f9687c7d7c28ba208f

    • Size

      657KB

    • MD5

      98a9df22205600f9687c7d7c28ba208f

    • SHA1

      c8163b051ab22fc9571681ad8605f3c7e356240e

    • SHA256

      e5a0cbed2e9fea774407469a6d122b44fd311fae59febc5a3c21634d03033b18

    • SHA512

      657cc982521a533af4219acead2c44cfa7a91d41bc12606c9213d030ef65c43535ddc6263116d7c317cfa08b8c7ba39de339e27710d979b0256c6ef8cd7890ec

    • SSDEEP

      12288:fMQblG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BUq4kaBQTcJ8ePx/r5uO7zU26OB8:fMMlG4GQm4OaHYJ8eP4D5uOHBBJ4kawr

    Score
    7/10
    adwarediscoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    behavioral3behavioral4

    • Target

      ffRichMediaViewV1release2757chaction.js

    • Size

      864B

    • MD5

      69fcaa4c4ab2448058d1c61f7c541c2c

    • SHA1

      63a7939dba99949184f9e5c499c95ab046aa149f

    • SHA256

      5f5632230378a7b59998cf4cecf2f0e5cc26f9e94bd63e162ade74e8cc2a9d7f

    • SHA512

      694dfd0cacda3979efd41441208cc39e544acb34339efea2c39e6ff4148f852c9adbd09f88de7de309a3454d25e96f0c874fb3db77eb6b39ad3498e67d54252f

    Score
    1/10
    behavioral5behavioral6

    • Target

      ff/chrome/content/ffRichMediaViewV1release2757.js

    • Size

      765B

    • MD5

      b6adea67e20927dd742b2ac44e93c3e4

    • SHA1

      c5048b863e56beae493bbe4b3914648c633684ab

    • SHA256

      4108e47641ba612734b3e254e14b6fef1ae590d965a6a88216c526654a7ecf18

    • SHA512

      bb9245c57f383cf63ef54317e0e9be374dd1d08a0b4f5d340c27ef49d0f3bcee0e26889b5fa5384349b99e1a19e0a9874109efaf6c32802a79bfdfa1731561e0

    Score
    1/10
    behavioral7behavioral8

    • Target

      ff/chrome/content/ffRichMediaViewV1release2757ffaction.js

    • Size

      702B

    • MD5

      f30d4264a4a31c11bfb3ccfb0cf81354

    • SHA1

      e59c0a6572fc5a4c36940c1893d0a682f5a081e6

    • SHA256

      8e11dbf6625c0405f6a01237dca04ddbba8d1f216a36ee42559ee66ef050799b

    • SHA512

      f4bf3611fb0cbfac3936302ae5ad48922665aa129d57d8443ee6df8a1f81c0fafa7f592a919c11d22623c16ce8c2be522ea691fcdcf83928153a920dec2466ab

    Score
    1/10
    behavioral10behavioral9

    • Target

      ie/RichMediaViewV1release2757.dll

    • Size

      85KB

    • MD5

      9a007a7a3ac50634aa58da5b685cea75

    • SHA1

      2d6baca6e7f510b1c73256bc60a94549f3b3a965

    • SHA256

      39b15f1d7ea5532f3b31e0eb6052ba1a426d824af317c47473b749aebec33596

    • SHA512

      9ad9272c06ed70adf54e5ac9992870e1fc15505bbda3dcb36e34c9ad627c578e8a4ba5038e5e214c0480f6b4b36b3f2a08b657dbebadb47ddb44217c5acfd04f

    • SSDEEP

      1536:7hMWCsgyMIwP/t6hp1ZcTkrChDCTfLlQxxAKS:iWKyMIwP16hp1+DgaxxA3

    Score
    6/10
    adwarestealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral11behavioral12

    • Target

      uninstall.exe

    • Size

      289KB

    • MD5

      e78d3a338a27c502bdc409163af1b525

    • SHA1

      1655eec783592d7060a936ae187f50ed4002e53f

    • SHA256

      d08c9ae733072ab3d65b3bc3be3465e09aacc6b9b2f409144b4037cd4e4f9880

    • SHA512

      b071c9204a40a0b2ea4bb3cf489874b2e57fb70ca3e4bd1a94676382b011465f16044dc1442c956afe5563cabfd1184e38f0f235c54809585bb558e61a02a223

    • SSDEEP

      6144:Ue34gIRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmb:FIq4OaQQTYJ8eP4/L5uO7D3f5Bi

    Score
    7/10
    spywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks