52d2d81e1111c5f050718ba3efa7d5f5c1492a9266721569de939a28b98c9f18 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_09853405faa77e04f17ea98050f1d170
Size 634KB
Sample240204-znq8dscecl
SHA256 52d2d81e1111c5f050718ba3efa7d5f5c1492a9266721569de939a28b98c9f18
MD5 09853405faa77e04f17ea98050f1d170
SHA1 7436031b7bd018953153607d22f59f59870a4301
SHA512 0039b91c09d8af3220f284dab433f9037b030c94b12753124d7a5619b13228f358e19fff81e91d73ca46c48bf384288726f0bb42cfc1158ff3ae7b45150743b5
SSDEEP 12288:by0AqXMMDBG4GjeZHkwuPikQ7lKH5p5H9x1I0eZHkwuTiBQVlKz5p9xl/lf+:by0AIbDBG4GjeZEXi37l6Br1I0eZELi4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_09853405faa77e04f17ea98050f1d170
- Size 634KB
- SHA256 52d2d81e1111c5f050718ba3efa7d5f5c1492a9266721569de939a28b98c9f18
- MD5 09853405faa77e04f17ea98050f1d170
- SHA1 7436031b7bd018953153607d22f59f59870a4301
- SHA512 0039b91c09d8af3220f284dab433f9037b030c94b12753124d7a5619b13228f358e19fff81e91d73ca46c48bf384288726f0bb42cfc1158ff3ae7b45150743b5
- SSDEEP 12288:by0AqXMMDBG4GjeZHkwuPikQ7lKH5p5H9x1I0eZHkwuTiBQVlKz5p9xl/lf+:by0AIbDBG4GjeZEXi37l6Br1I0eZELi4
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home687chaction.js
- Size 829B
- SHA256 6f4dc0fc15fc497371529893dccf98317b10d2e09dc1c442a6a93a47b3c0a9e5
- MD5 914030413f9979df66b7add2a07bd5fc
- SHA1 b46bb1c354fbc0b79ac5fe98fb16c1d9ecd29393
- SHA512 18cd8cdedbf654065d916e000b68daf05032042fa7c85f9c174511beaca64591aed040166afda3f71b96079b319430bc743a6a122113ccb0fedccc369ec8995d
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home687.js
- Size 744B
- SHA256 daa18ab5994216f6f0a255f458cf215efbafd1ece96f8d347a629117af5a166c
- MD5 48f2ffa6ae56ea5cb2c159c7671db9ae
- SHA1 84178e15446af0c08fca0242edeaba2122d823d6
- SHA512 fece7a8ec3d7ba973e8351b7a5ed83cec5845e8b5edd53ae6196ee54794369f9be2bcf6fbde9df99d5c3540f33d8f2ec3a8a6f17ddd1f106b1e94074c2fd3eb9
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home687ffaction.js
- Size 674B
- SHA256 ed1ae00c24aabaf47958f6e69d17c395c4acf84d0910dfa882bc5d3462cb59f3
- MD5 85c08eabf1b51b8ef552d691c4ee421e
- SHA1 9e4c731fa23988a464505cf356c1ba26d9d2e710
- SHA512 84dca46a93de257ccddaae2b7197fd5feb5e674ddf84d01aa98dce7522297e29fd4b74ee99cc3c755ed4484b0a3fafcb031fe6fdc778ba8c0d7289a9b582e04c
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home687.dll
- Size 85KB
- SHA256 5dafdd80f9be35edd0bce0c1204f6672fd543262e4935312cc8e553a528532c8
- MD5 d2c45dbcb7898eb43e6c7770ebe9a054
- SHA1 99705754d9870dbefffefa2967b5140df5aaf28b
- SHA512 94af309bc6045c04d50bccedf3374655a4bd5e5d05799b4819e32838d9d9e9703dfa8f1c23191adaf2445747c3c68a4e043bc69d4ed51d89f39c31f395c1df6f
- SSDEEP 1536:/n/1CsEmkaMAPtahrOb8DktPsHA9glQKJxR1:X12mkaMAFahrOPsguaKJ/
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 74aefd881f3b4609302f4a3d9202dfcda35d9bdfc18cd006f8722ea47f6b868e
- MD5 a77b11c666e3aae0b94dad93c44e3bc9
- SHA1 d7edc5fbcc46fc3365bd5f1db3daf8d8a851160a
- SHA512 41d4dcfd32200acb03c93d87819f1edbd4034dd8a1b800dec800913ee64122d523e1c1ecc01f74fc7d01e1ca5b129c8b45b8f4cbae15152f7397d5b08726c272
- SSDEEP 6144:Ee34sMIpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1V:JM0eZHkwuPikQ7lKH5p5H9x1V
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16