18f807416a6d91f878ee2008b8cdb1638f7c9a759efbec15e984caecc9f179f7 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_6cef53812dca6db17872a41b15b28cb2
Size 634KB
Sample240204-tstanagbfk
SHA256 18f807416a6d91f878ee2008b8cdb1638f7c9a759efbec15e984caecc9f179f7
MD5 6cef53812dca6db17872a41b15b28cb2
SHA1 d641fd8cb15634a8391b8d6a7e2e204d905adad7
SHA512 1586db052a80d61a88134484f3faacf5a9305e7b22ca0ffa35302334f3f6d993bab13d81f3775f4490eb9f6d5684828b9e094ee75d3d9615940505fe5ebd98c0
SSDEEP 12288:4JTG4GjeZHkwuPikQ7lKH5p5H9x1neZHkwuTiBQVlKz5p9xl/lfy:4JTG4GjeZEXi37l6Br1neZELiGVls1f4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_6cef53812dca6db17872a41b15b28cb2
- Size 634KB
- SHA256 18f807416a6d91f878ee2008b8cdb1638f7c9a759efbec15e984caecc9f179f7
- MD5 6cef53812dca6db17872a41b15b28cb2
- SHA1 d641fd8cb15634a8391b8d6a7e2e204d905adad7
- SHA512 1586db052a80d61a88134484f3faacf5a9305e7b22ca0ffa35302334f3f6d993bab13d81f3775f4490eb9f6d5684828b9e094ee75d3d9615940505fe5ebd98c0
- SSDEEP 12288:4JTG4GjeZHkwuPikQ7lKH5p5H9x1neZHkwuTiBQVlKz5p9xl/lfy:4JTG4GjeZEXi37l6Br1neZELiGVls1f4
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home3046chaction.js
- Size 834B
- SHA256 fabb22c857d1ec41fef581c03114faaac5e539729ed8f22667d5b9ff02c88f2a
- MD5 630bbd8764dee39688df94755b313e31
- SHA1 b8b25dbd562a4a3030fc141a54d61836b427e690
- SHA512 efe1d28478dfd94836fc0eb887ab6ef61d101c82fbae6e49fa7c17c6475756383013f48b0716b23389ceda78a53268807769f8c8d326e13b848e3765b858ab4b
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home3046.js
- Size 747B
- SHA256 d7d715d6519413f186e6faa695889d931fb094eff20ee4a093641dbfbe0286a2
- MD5 6acf25204d54590ba96255df8ca416b9
- SHA1 664d844142912403508eab80f8f25eb460794c40
- SHA512 14bd928d5a1e4162d0004dfd9c129f297fd1a4752a32ddcfd00392e7f92cfc18c2d10e6fd92bc8b1cf8a9e3df84c55b1c2e31cf1dfd2ee40e3e4fadd8bd4c2aa
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home3046ffaction.js
- Size 678B
- SHA256 34cdb12e8ffe6d91f80b4685169358255c8d45c7095ae566eefba56fc56e7549
- MD5 6af6f09760e3cb786b4003b6b9967913
- SHA1 5fda13dd4edb16e8c6119b8a51efc8fa9b200399
- SHA512 2a377b08ff0859f6010f4612f8b8556f288aa41133bf40e859af8a8780cc0715392175a08b4c390220f6d9a123c031121d3f0cf50ebea1582358dea13b00dc06
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home3046.dll
- Size 85KB
- SHA256 bb29aa10b8a138e580caa9d1275b85d0c72dac2ad769ee686d191389ef362e0d
- MD5 1b41a959e93ec9bb510faa04cb63396f
- SHA1 1f1d08bc0c59edb5d585ae6cbf3ef40bc5c0fb6a
- SHA512 4f11f50195949f8c1a7908c6149264e63d05b814f09577ea38254f285d4e700aa3ce1713d52934a2aa14ef0e68bc2fca94c7d988bf04a70d75e314be846b1f18
- SSDEEP 1536:p8/1CsEmka04RhRtahrOb8DkhE9HA9glQ81/Z:i12mka0ElahrOQ9gua81/
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 39053d2fb6b3463d8270530fa09351156da25348e186eb33511980d7a6c5b8cd
- MD5 bfe2be2406fc6a1427ccb70ec0c9d882
- SHA1 f5b35571cc47673bb27e8e4ddddc2295fa1a4863
- SHA512 98c1361ffdfa347d1eefc8faf1503f7479ee70be9a96b04779fdcca0663318b44376fb8d5970e83b9fb6dbe8ec3d2cae0796721f753ab03acea7d7a62ec1a4e5
- SSDEEP 6144:Ee34nlpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1T:+TeZHkwuPikQ7lKH5p5H9x1T
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16