47a75b61d11baf1a55a3e5891a473af8bdb28c31d0517bb344428066d7793949 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_4a9548854beab57f1606eb25d3f2244b
Size 634KB
Sample240205-j3vlcsbcc5
SHA256 47a75b61d11baf1a55a3e5891a473af8bdb28c31d0517bb344428066d7793949
MD5 4a9548854beab57f1606eb25d3f2244b
SHA1 870d6f391bd60f7b1e6a02e74da3ff9cb8b37230
SHA512 664f0bfc53a2f95e39af8a2916b9111da3b3b9ba8f7aa1ee57b53283e39d24ef657cd08da85f6986ca53949d61213fce22ea4dcd6e0924b75222454111cdbf41
SSDEEP 12288:cr//vs/MG4GjeZHkwuPikQ7lKH5p5H9x18eZHkwuXi5QvlK75pnxWlfW:czvs/MG4GjeZEXi37l6Br18eZEviuvla
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_4a9548854beab57f1606eb25d3f2244b
- Size 634KB
- SHA256 47a75b61d11baf1a55a3e5891a473af8bdb28c31d0517bb344428066d7793949
- MD5 4a9548854beab57f1606eb25d3f2244b
- SHA1 870d6f391bd60f7b1e6a02e74da3ff9cb8b37230
- SHA512 664f0bfc53a2f95e39af8a2916b9111da3b3b9ba8f7aa1ee57b53283e39d24ef657cd08da85f6986ca53949d61213fce22ea4dcd6e0924b75222454111cdbf41
- SSDEEP 12288:cr//vs/MG4GjeZHkwuPikQ7lKH5p5H9x18eZHkwuXi5QvlK75pnxWlfW:czvs/MG4GjeZEXi37l6Br18eZEviuvla
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home2456chaction.js
- Size 834B
- SHA256 a2d8bcc31031423a5fc96c528bd6a4c008835e98957f7cba63cd66bda8457d54
- MD5 76613e238e0faea88059734f3db096d4
- SHA1 5be3d165505848e56af1f704b8ee58129cf4d5ff
- SHA512 c8c415d72d4c8d37d3543612d7b577e4006bc8ce74f2f2b5dd3743ddf120213a3fd553a7379edd70b997ee12866f39daa100ceda1fc461a4c8f7c745dea48aee
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home2456.js
- Size 747B
- SHA256 9eecc19833a1b333f72bc0393db717465f4aeb83e73fe2a93272f67bdb2e4383
- MD5 ecf28aa796d03221d2847c0bb38b91f9
- SHA1 f36dcd3a96a1da765dcf0470501ca3caaefc29be
- SHA512 ef3218e00eecee79489b080ab0feb83b21f96e2c29b3bed9d69f69990dd57c34d3c7152465dc13e17f56ea14bfc3b9836304e742771b993ef6cbb7e8d7cd0a70
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home2456ffaction.js
- Size 678B
- SHA256 0decc8facba845c0f1c55afcec443061e5c3a62bc7712a7b4f3603756413ae0d
- MD5 3e97860649f7e2cbfefcbd83e49d7514
- SHA1 0fa6c03c67a1e4b34bea98ce8a6176f2e6e15b43
- SHA512 9494ff8db930d1c5f3efc8ffdb3d52b35315c006a239f7933ed7e87a1a57dcdb2be761933d4b76ac801bf3fd94c57f15bf68236cd8870cb1a65272bc78d5abff
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home2456.dll
- Size 85KB
- SHA256 58c627b2b717c57599b2d222d5dd83485bff5f9593063623f6e12bbc10e51957
- MD5 51e35bccbf8769800aa1c4f73fe6dd06
- SHA1 498e4637a5009af71ccce5d0aac7dcb9c6cadd1c
- SHA512 773ea82ba1b1d873cf6ecb6a3130f8e05293358704505fdf4b922c919eb26a02ce53138a93515f3e9ab8af0549c2dacea0bda93ff02b1d39e928822faa67e29f
- SSDEEP 1536:c8/1CsEmka04RhRtahrOb8DkhyWHA9glQANh5:H12mka0ElahrO2WguaANh
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 3f370c8baa04fbe140ed5d2ce3ae7435afcce5b32467e826c05c1b809d292e62
- MD5 8e7dd503868dc80b8c749182faa71554
- SHA1 a2b21f488cfddc870e8d9a4f8fb48e61d7d883e4
- SHA512 21708cd9f9f4d2e94363fadc18aff0086ce5c4ba59d52a290711d4b76d9d755de822d3fc85f554a3d71639a09bc67bdf124d3e6a92eb226f1154b99bf52c3b42
- SSDEEP 6144:Ee347speZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1e:aweZHkwuPikQ7lKH5p5H9x1e
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16