dce1998da66274d4bced614f1d378ea87ea07c7b3677de3b4652398ffe7b0cf8 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_551459045dcbe02c2ab748a954090339
Size 634KB
Sample240204-trbn8aeac8
SHA256 dce1998da66274d4bced614f1d378ea87ea07c7b3677de3b4652398ffe7b0cf8
MD5 551459045dcbe02c2ab748a954090339
SHA1 14f2dfbd3ccf873196d7ca5bae1d3e7efe8fe385
SHA512 fffce74bb890f7f0232504b31fd3e841fbbe9f23d1eb665f82190149c64b7f0b48b6d7dab4a8591affd267db2fed9113b3d41230b2d443b46f009d78cefa83f7
SSDEEP 12288:MJyvhIaG4GjeZHkwuPikQ7lKH5p5H9x1SueZHkwuTiBQVlKz5p9xl/lfU:MJehIaG4GjeZEXi37l6Br1SueZELiGVz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_551459045dcbe02c2ab748a954090339
- Size 634KB
- SHA256 dce1998da66274d4bced614f1d378ea87ea07c7b3677de3b4652398ffe7b0cf8
- MD5 551459045dcbe02c2ab748a954090339
- SHA1 14f2dfbd3ccf873196d7ca5bae1d3e7efe8fe385
- SHA512 fffce74bb890f7f0232504b31fd3e841fbbe9f23d1eb665f82190149c64b7f0b48b6d7dab4a8591affd267db2fed9113b3d41230b2d443b46f009d78cefa83f7
- SSDEEP 12288:MJyvhIaG4GjeZHkwuPikQ7lKH5p5H9x1SueZHkwuTiBQVlKz5p9xl/lfU:MJehIaG4GjeZEXi37l6Br1SueZELiGVz
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home981chaction.js
- Size 829B
- SHA256 a939186969c42fd4cfccdf3d32d34226f3667a03c635c060489350ba13d8a7c1
- MD5 c0fc0ab0c41c275af57a0a4ba996bb49
- SHA1 986ea436b1176fc708c3ce57267e703ae11854fa
- SHA512 5895c5d795afe16b7008434d558d952b46fe579f6d6407fed26c498c7879452b8155e99f11a7905014f236f884c54c18bae77b829590d28d46519809cb61a9a3
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home981.js
- Size 744B
- SHA256 238acfc7d3c339d56e3e8166952be90e9b8dd458f2f117a5ed41c844a89a71bc
- MD5 29c999ca1b63063bc0bf58b2ad1b60ec
- SHA1 158dc3df988c48e5971c10bb058e5e4309dc7cc3
- SHA512 81ad2ca1470f0aac12adffcb7a4186d8d73c5180fbf02373d72547754884f9edb008ad4332b069cf3bb0c941e150812b3dfeac1303f4b56c4e344799445c5c06
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home981ffaction.js
- Size 674B
- SHA256 53a4ad607764eabf428a849081200fef2d33d8832e5f29b78256d63d1f9d9572
- MD5 d97eb96a3e0c2a44ebdae0ea215a1fdf
- SHA1 8515770c2146f45e235e3d16b00b381984fc72d3
- SHA512 a1b123ed0a1567716853117c26d041ce4f7fce5a15a1b3329e9ee28b9c8befb0ff9b31b65c59c5190424147a2e901333e65e4726469e0b58c3c130a738b3157a
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home981.dll
- Size 85KB
- SHA256 f0d22a4df0d2bd36440fb5e6a38502bba071925be30c5db7bd54210929404fe2
- MD5 2a44d6de9e2fa2b86fc24997df467a33
- SHA1 81324309dee2e1b63a6e1e4e59bf2ef6b9efce73
- SHA512 818e8c96c0349e82bebec4d293424071a94c3fd68744226ef49fdcc274e52b8c48160062b5fed7f11327daacf052e063000d40ae15c42eb21232e50f6e893a19
- SSDEEP 1536:T3flScQkGMA5tasrOb8Dk9OIHgNglQYuI+:TlikGMAbasrOyIA+aYu7
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 e8212da8f2dc78e077ff5267f3fad800a42844c4ea33f620fa78c028c586612c
- MD5 7083abe46a8e01c850d09c7ba67ea23f
- SHA1 99ddb80a7341ce81338affcfc085a88c7451854f
- SHA512 681b7ceeef78b4a7987f36ef4903f5811423da3e22ca9dcc7e05193836b0a17a949d41addc7d0fe3adc5059f2fea966da693b08b04e7e256bf87d16a6d44abb2
- SSDEEP 6144:Ee347GmpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1Q:qGueZHkwuPikQ7lKH5p5H9x1Q
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16