General

  • Target

    VirusShare_0d9037b0130612be3ebe4f9b3ab16ce7

  • Size

    634KB

  • Sample

    240204-tlkd6sfhdr

  • MD5

    0d9037b0130612be3ebe4f9b3ab16ce7

  • SHA1

    803e9b740f90c19f125543f65c3c72a31ddc7f8b

  • SHA256

    35bcf5f71e9241950ac836f30e961dafd3969537c21bb34d1f50122e9fe90c60

  • SHA512

    8750b70cd648cf310b071fee72e201bedb614af7d4dc3b665c991145672d1c80b9021b4197dd3c98c4cf2815c3a8f56bed8948bd98c61763c4863bc59acb491e

  • SSDEEP

    12288:tTCu5wF+G4GjeZHkwuPikQ7lKH5p5H9x17eZHkwuDifQJlKr5pgx+Td8zb7:tTChgG4GjeZEXi37l6Br17eZE7i4JlAO

Malware Config

Targets

    • Target

      VirusShare_0d9037b0130612be3ebe4f9b3ab16ce7

    • Size

      634KB

    • MD5

      0d9037b0130612be3ebe4f9b3ab16ce7

    • SHA1

      803e9b740f90c19f125543f65c3c72a31ddc7f8b

    • SHA256

      35bcf5f71e9241950ac836f30e961dafd3969537c21bb34d1f50122e9fe90c60

    • SHA512

      8750b70cd648cf310b071fee72e201bedb614af7d4dc3b665c991145672d1c80b9021b4197dd3c98c4cf2815c3a8f56bed8948bd98c61763c4863bc59acb491e

    • SSDEEP

      12288:tTCu5wF+G4GjeZHkwuPikQ7lKH5p5H9x17eZHkwuDifQJlKr5pgx+Td8zb7:tTChgG4GjeZEXi37l6Br17eZE7i4JlAO

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      559KB

    • MD5

      51ba1095f0ae45a2d444bea506cb9ad4

    • SHA1

      038a5d53d055a6d440bd2c8864c2f51db206c5e5

    • SHA256

      b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539

    • SHA512

      f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361

    • SSDEEP

      12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN

    Score
    3/10
    • Target

      ffMediaWatchV1home2738chaction.js

    • Size

      834B

    • MD5

      bbfe720c5365223563eb91076a97b09e

    • SHA1

      632a59029bcefe1bc0baaa67710519d1dd36e0b6

    • SHA256

      45057f4e75494c0084aa8c0b84f9b4cce50df9074e935f2e6a512af70e99a1ce

    • SHA512

      b43602dba23edf762b58d0ca00fcbdd5d383ab42e4b7b7f45e22ec97931129680b7d41e921418d45c66ee998475dc00413039bc18dc265cc06989d65a034bccf

    Score
    1/10
    • Target

      ff/chrome/content/ffMediaWatchV1home2738.js

    • Size

      747B

    • MD5

      95bd388e0538eda961031b966c7b7044

    • SHA1

      7916bb38597bd575b270a6dcadc9e1b801061b56

    • SHA256

      83b807a16fa48a3dbdc14ff078b80a69c6be74e23861f32a29fbbe03bac65e3e

    • SHA512

      923dce6f0f2e0bf1c5f409ae40004232d51aca78e76dac87255495e75b61664d90e813c6cb9b11efb9b470a2291043650b24e361d8b875b7a03f96111700256d

    Score
    1/10
    • Target

      ff/chrome/content/ffMediaWatchV1home2738ffaction.js

    • Size

      678B

    • MD5

      bcbb5281343f049d24a0d484e3b92f25

    • SHA1

      cead11e441375154705ce8952baeb6718f07caaf

    • SHA256

      dcfc5ea104be1483cc4b1195b80d06ad72cc510845d3d69ea12ae23ca3fde696

    • SHA512

      7ec2767f9d30d2ab6ff33480eb6a188739fd4f27eb1f852528885fa2a2ae8d833df393e2811076676e5fd3b2bfa032683ed06215e6e1cd50d0338fe7b2eeb750

    Score
    1/10
    • Target

      ie/MediaWatchV1home2738.dll

    • Size

      85KB

    • MD5

      8b1f2af4b8c76c1abfa17fc72787b1ac

    • SHA1

      273b656942f83e5d2a69ac8273adc3e05dfb8a5f

    • SHA256

      325b35bd8af5c506287d0771e7da9280c35a27c9e906684c6479f74d9c76e445

    • SHA512

      66a7b9a4f433b05c0c60dd905ba43c1ef8e78064f4e874213fbbc7f1015844d834fc46d0a0e44e4d7bab799c3826590924904f9bedfb15e460c225d0e7567663

    • SSDEEP

      1536:bMflScQkG04RvxtakrOb8Dkx/6HgNglQgqw:ElikG0EbakrOv6A+agqw

    Score
    6/10
    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Target

      uninstall.exe

    • Size

      285KB

    • MD5

      4444f63f4adb0d2fe363894c5e2351b0

    • SHA1

      488d340dd2de3dd022b146e2892bd48e1567d3b9

    • SHA256

      2a53a664ff16fa83e3c8afec5628f5967fce4b9b4c4a1f193c400b68e2fcc044

    • SHA512

      74153fdb38a91745a550254c41f641454dbef12ce432f62e9a22bfd8077509dfd70717e64ae327752da21403f41612bba1f2a0bd8c485a8606bc1c9657a02058

    • SSDEEP

      6144:Ee34OBEpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1U:3ueZHkwuPikQ7lKH5p5H9x1U

    Score
    7/10
    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      559KB

    • MD5

      51ba1095f0ae45a2d444bea506cb9ad4

    • SHA1

      038a5d53d055a6d440bd2c8864c2f51db206c5e5

    • SHA256

      b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539

    • SHA512

      f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361

    • SSDEEP

      12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks