General

  • Target

    VirusShare_1f7c473b4ce03611577287b4f2c0a5f7

  • Size

    657KB

  • Sample

    240204-zqfvfacehn

  • MD5

    1f7c473b4ce03611577287b4f2c0a5f7

  • SHA1

    323015d00e2b21d107fb1662cfaf5c520f97687d

  • SHA256

    a7d81495794a1f80bf2b1f4fcafdd17e478d3c981cfdb9b8c8d9916691c5a0cc

  • SHA512

    7f6de3fd3c7f5b9ed4a82af6b0e6fba1016d6567c9a334c881c1861c28831eaaaa3e23a86e93d286979f147c89a3dd72cc3d1e81637189eae658580a11404a73

  • SSDEEP

    12288:0DhG4q1ezplJG4GQTq4OaQQTYJ8eP4/L5uO7D3f5B5q4karQTuJ8ePP/h5uO7kUG:0FG4fzDJG4GQm4OaHYJ8eP4D5uOHBB89

Malware Config

Targets

    • Target

      VirusShare_1f7c473b4ce03611577287b4f2c0a5f7

    • Size

      657KB

    • MD5

      1f7c473b4ce03611577287b4f2c0a5f7

    • SHA1

      323015d00e2b21d107fb1662cfaf5c520f97687d

    • SHA256

      a7d81495794a1f80bf2b1f4fcafdd17e478d3c981cfdb9b8c8d9916691c5a0cc

    • SHA512

      7f6de3fd3c7f5b9ed4a82af6b0e6fba1016d6567c9a334c881c1861c28831eaaaa3e23a86e93d286979f147c89a3dd72cc3d1e81637189eae658580a11404a73

    • SSDEEP

      12288:0DhG4q1ezplJG4GQTq4OaQQTYJ8eP4/L5uO7D3f5B5q4karQTuJ8ePP/h5uO7kUG:0FG4fzDJG4GQm4OaHYJ8eP4D5uOHBB89

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    • Target

      ffRichMediaViewV1release1113chaction.js

    • Size

      864B

    • MD5

      25a93ca36a3d9f8b3ead5c2fa522232a

    • SHA1

      759eadb22a5f58d3dfb21d93c484f28384c7c153

    • SHA256

      6220e5fb6f181cdc9acc09b90c72e0feb766bfd6f2cc9d0d272c31dba0ade88a

    • SHA512

      178f43e63eaff28a031be8ab2bc51540193b75d451ad7aec649cdc02dbe63f7cba222622acd698c72c98cc207a95a3b247cc618ad511c5b42d0ee00f77601216

    Score
    1/10
    • Target

      ff/chrome/content/ffRichMediaViewV1release1113.js

    • Size

      765B

    • MD5

      ce422367410128cecbb36554d7502a36

    • SHA1

      16560eb89a20a2b782fb4d4b6b304de199b7a89a

    • SHA256

      1f6f720f0382b5e27a594e7cc7ad392f6b443d5080f77c4ebfe1e681c72304eb

    • SHA512

      e4d1cf75060df13c19661c549c5e3381f31194c723f639d4b3d882fd9a5ad201c0c56e3bef6f7dfbad81ff3861dd7b3e73e00f7d3250127d8fa46171ac38e503

    Score
    1/10
    • Target

      ff/chrome/content/ffRichMediaViewV1release1113ffaction.js

    • Size

      702B

    • MD5

      687328107b14b3c5c0231e432b6ab10b

    • SHA1

      b13ac56e1413674c77fa9881acbf1660a7791c89

    • SHA256

      9b3f5af8831cf89c8bc323993b010c1070d6599459930a7812d805b92caf97d4

    • SHA512

      67358ecedbb695011d99d43f2b7dce67d180718db2322547a87e8a01d382de294424c20a2f91e792c39535bfa96b7a7ae68e51fb34f9cf73b45a98f409ea4721

    Score
    1/10
    • Target

      ie/RichMediaViewV1release1113.dll

    • Size

      85KB

    • MD5

      b27e384c32b0939200d0ae23cc1b1141

    • SHA1

      9132bede535ca5e3aa4197113aacb7d9b4712991

    • SHA256

      e21c69a0e92f63fff61a04313adcb7724c3f1fca8e4d975d1652a17e33a6b067

    • SHA512

      02a5a7cc39b23bffd67d3bbcc4fcf4bff9b6591844aff5491970a2ea1ceb5c220bc152d2a635f023f46aef7e8a7ca7efdbf824d07b2a7507cd38f7c9095bfcb5

    • SSDEEP

      1536:shMWCsgyMIwP/t6hp1ZcTkrCWGCTfLlQJz+6S:BWKyMIwP16hp1dGgaJz+n

    Score
    6/10
    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Target

      uninstall.exe

    • Size

      289KB

    • MD5

      8c3b7ae4835e1f49ae13f635df8519a8

    • SHA1

      2367464e23ef2311d4e5f5c33d7f6689c72af74c

    • SHA256

      c793f04ab83d0ce8810ff078b368e35462c45298ec44c1c99b57e595a3a94252

    • SHA512

      74fb310d8d5f5f6d180dfec195a07638cf53f52b19f3ba311ff82aecc87fbf9a2c4c068909e4a9bd37343e830d6da74bc51ba566a80d047d008b8f212e64f983

    • SSDEEP

      6144:Ue34DXRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmG:iXq4OaQQTYJ8eP4/L5uO7D3f5Br

    Score
    7/10
    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks