8bc048f9bede0090e4336fa3304ac0ab71da97026c7962104751b61aec3e25c0 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_f8923215e5f311b08cd9d06f0360a6c9
Size 657KB
Sample240204-tk8elsfhcr
SHA256 8bc048f9bede0090e4336fa3304ac0ab71da97026c7962104751b61aec3e25c0
MD5 f8923215e5f311b08cd9d06f0360a6c9
SHA1 5ab97d88cc2fe39fb4328915412b201ea6fd3ba8
SHA512 46236b3a2397ef5e23aa66ea9ddd9746bd54f9aa069890efc9e4135e96ebc2d4f03cafa2c20a6e8d929ce4362669d6277e08b8e31a8b7df845343b8631e61416
SSDEEP 12288:HRUG1JFDG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BJq4Ga7QT2J8ePP/Z5uO7FApmz/4:H3DG4GQm4OaHYJ8eP4D5uOHBBM4Gai2w
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_f8923215e5f311b08cd9d06f0360a6c9
- Size 657KB
- SHA256 8bc048f9bede0090e4336fa3304ac0ab71da97026c7962104751b61aec3e25c0
- MD5 f8923215e5f311b08cd9d06f0360a6c9
- SHA1 5ab97d88cc2fe39fb4328915412b201ea6fd3ba8
- SHA512 46236b3a2397ef5e23aa66ea9ddd9746bd54f9aa069890efc9e4135e96ebc2d4f03cafa2c20a6e8d929ce4362669d6277e08b8e31a8b7df845343b8631e61416
- SSDEEP 12288:HRUG1JFDG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BJq4Ga7QT2J8ePP/Z5uO7FApmz/4:H3DG4GQm4OaHYJ8eP4D5uOHBBM4Gai2w
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 567KB
- SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- MD5 450753ad96785a240a39deccab3af0d0
- SHA1 21c544064d2ffa6444508268ce258a330d459fc5
- SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffRichMediaViewV1release141chaction.js
- Size 859B
- SHA256 269ea26e4cdd09b1b360e4f1b190edb918d157e3f5593c4e85be4c2e169999b0
- MD5 03b6cc478d7d1668f69f03a6806105ec
- SHA1 ba074953c8a3ab77202faf9c73db346f7e9e8968
- SHA512 f1df2151312023a5c3de3b70fd4f25c128b900e8f2a430cc4b6e8a9e617458ec4e4b4afdd41cf3359ae947a0ffc2c17079046761020ce608943073c1de192783
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffRichMediaViewV1release141.js
- Size 762B
- SHA256 0db27d30345fb823c71300cc29fd06d6239e6097d8958ad8a13ec3c1ac63205c
- MD5 7b3fc611f3c0198252760bae4a09ffee
- SHA1 13f6efbe8c0fd2c8854ec5bf548af542b74a1a21
- SHA512 4af4e7b9a6e40fe29200ef4feca9fd82d1f9411fb9ca8e592b04adc1bf3f1baa3be9118c7c16d8a7314d7fd8077ecb203d8df7477abce424be63fc701c7d481a
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffRichMediaViewV1release141ffaction.js
- Size 698B
- SHA256 79d629c7252b3c7b6436840a478479eb2ec7027f77079050de4c4b419140f32a
- MD5 e6f0cece5d497f38ac3e5c1a34980364
- SHA1 7bae829e01bf44ffa4c5f8e1c3952b557d16e225
- SHA512 f687a7c81c851c4ae9d97d81973e5fd3b40e92a8b4b8feff0d0231fcb685e9c7dbcd7255859e96dbd4c6161b453760d0584b5267921604f4da3eb539c92eeed3
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/RichMediaViewV1release141.dll
- Size 85KB
- SHA256 0af78ee97aaddc5e9ee2d6f59c1988451267cbf702adb1cb543528e9b8eb05b2
- MD5 8b77c1616000c06d637b803940ebef36
- SHA1 7be083705349830f0dbf17b491e82b95bc5cf0a6
- SHA512 3c26080c71cbf814f083223d5a45ec5ef7c9da1a585a56ca3b67a24fdb9d8b8f976c53003f78b39bf162652b0495fc9fc3d7d76573f2ce52a58d46ba065ba384
- SSDEEP 1536:9kf9Csc+EE7Msd5N60GlVk8jkrw95nqLhPLlQajwtBZ:O9++EEwsJ6FlV95nmaajw9
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 289KB
- SHA256 9b763be68d1c34d95a8617a2becc59ca56a82dbe6be78e4d234005e9fdc62597
- MD5 8ece4edaa62521f2071356e1e9cd55b8
- SHA1 5ce411f6885c70fc5c00c5857aa1e4d09d1b18df
- SHA512 08baefb04b9b111a2fcd342db7b299f6e90ca8c0b9ff189d36a6570bce3b899f445bccb7a7d1dcdba6605871af729dc0b20d89d8316503bcc3104c5abf1a0d48
- SSDEEP 6144:Ue34osRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bme:lsq4OaQQTYJ8eP4/L5uO7D3f5Br
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 567KB
- SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- MD5 450753ad96785a240a39deccab3af0d0
- SHA1 21c544064d2ffa6444508268ce258a330d459fc5
- SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16