5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52

Sharing

Copy URL Twitter E-mail

General

Target
DAMsetup.exe
Size 2.8MB
Sample240321-sep6eaeb39
SHA256 5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52
MD5 c4f6847c160205eaaba5af06dc3d5873
SHA1 74c1c9a22e85305cb21ff22e68800f96daaa8464
SHA512 997687ab9f5b1507690ffb6d474d7f3cb81d4204e5e7face86c5d1fb54030d8c7c53ad16e533650b5a88abbdf6ab84e58dd8b7d3adb6d049aa244d08d1a950bc
SSDEEP 49152:YKVrCbIS6kXtqMsSOqzw9iDxivzrp/SLyB+Lgyl8WLpqIDXssjromawYuwD:YKVry6ItqqkUVivXpGLLVpq3sPomy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  DAMsetup.exe
- Size 2.8MB
- SHA256 5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52
- MD5 c4f6847c160205eaaba5af06dc3d5873
- SHA1 74c1c9a22e85305cb21ff22e68800f96daaa8464
- SHA512 997687ab9f5b1507690ffb6d474d7f3cb81d4204e5e7face86c5d1fb54030d8c7c53ad16e533650b5a88abbdf6ab84e58dd8b7d3adb6d049aa244d08d1a950bc
- SSDEEP 49152:YKVrCbIS6kXtqMsSOqzw9iDxivzrp/SLyB+Lgyl8WLpqIDXssjromawYuwD:YKVry6ItqqkUVivXpGLLVpq3sPomy
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Dialer.dll
- Size 3KB
- SHA256 745acd94c78e5ea93268310977a83473825ad911bbea0a9ea3e4521170745adb
- MD5 4c225c3da808e6c95b6699c5db8c636b
- SHA1 a09dd7dabea628b9e7b38720e98ad6aa1a53d0bc
- SHA512 a35f81a34bec708db98f28906741298994cdf07ca09ee48e76e0f4f84277203df8912be8fa5cd489e980d86115788ff3dac778b9b967a401109a4152ae895740
- MD5 SHA1 SHA512
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/DotNetChecker.dll
- Size 815KB
- SHA256 3f7bed61a1f5ad0c0a468363c4f2974c2674fd018ce2aabd40b5a16604c2d4cd
- MD5 83b493e0bc0cf1105ce25d9bd5d1c2b9
- SHA1 1813bcb2a4384bd2a134bec29bd978f0b5c4e1b4
- SHA512 3aaccda41b5822d8eca0f8fb01c060151a1a19038c35905c937949491edc803ad7399f71ea7d56fded69394e4abb3f6266b3b3a8bcf644ef4bccb3406e3c2769
- SSDEEP 12288:/s3lPW//U+/ViiIuuaOVs51bWMt1wbdKfK3s+TGsNlmH:/O+qsPWMt1wbuKcgNK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
- MD5 8d5a5529462a9ba1ac068ee0502578c7
- SHA1 875e651e302ce0bfc8893f341cf19171fee25ea5
- SHA512 101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462
- SSDEEP 192:W4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjAK72dwF7dBOne:3n3T5KdHCMRD/R1cOnrjA+BO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 92KB
- SHA256 59622532708a74464095e77e867168bb28e7c35d3d92b58469f19eada34e2f73
- MD5 565644184c2d2d9eb07f6fa70b0f61c5
- SHA1 ec9eca126c99dbca789651002bb2017d10eab0fc
- SHA512 2e32c53d1f10789a3b604a34709e93dacfb693851e4befb96a0e69dd894f80e752510aab7bf437120be880e8b38253033f6dd283a9870b54b4b8ff13e993da01
- SSDEEP 1536:fO3Dhu1Fggjb6GCDMTF7Rq9fVGLgCf466g4m38goHB+d:fONu1Fg26hDMTF7Rq9fMcW4U8p+d
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
- MD5 b0c77267f13b2f87c084fd86ef51ccfc
- SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
- SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
- SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/UAC.dll
- Size 16KB
- SHA256 6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e
- MD5 acfb66ee6fc1f4266229ec6098fe1740
- SHA1 e1aeb31b11996015d7f17308e2f2bbe69d4e1476
- SHA512 bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303
- SSDEEP 192:u9ALVfpLcFB5yoMINGXZ8YJJS6gGi21FNZRfUOPwiAGQMAW5s+2oA5D8t8A:SAL/S0xIkZ8CL7hfUOPGMAW5BkDod
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsisdl.dll
- Size 14KB
- SHA256 a1e09fb1739ef7557d18104b0d6a4c7725e1ec293f5404c80402f57ff9ebb9d0
- MD5 a95c7af96416b2cd084fed4c07c8c291
- SHA1 0c62c2fd843ccb59784404ed36369784dc557671
- SHA512 427ef14b116b574c5558cc6bb0ce03ab37f891f2d7ab0f130e3cddd0265e6bd269c598ce93230e56cd41bb9d2649bbbaa2fa2c654d8116c0c6f79a6f3419d1dc
- SSDEEP 384:9ck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2NE:9ck76gibLCMLDLCx04HNVNE
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/registry.dll
- Size 16KB
- SHA256 ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1
- MD5 24a7a119e289f1b5b69f3d6cf258db7c
- SHA1 fec84298f9819adf155fcf4e9e57dd402636c177
- SHA512 fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861
- SSDEEP 384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  $TEMP/setupc.exe
- Size 6KB
- SHA256 55e37ec9db608c9dd898e3fd23975503e079a6f5ab82e0f9106014851ea2411f
- MD5 62738e8892a6d7b05cbb3b8a192afe9b
- SHA1 6546f3fc2b4d1301bbc57ea98e57ebdabcc4b9cd
- SHA512 b88a231bfaad80f9c50dead56287d4e2bd445d5471267dcf39805c42abe692225696f7afbafa4fbbf0b4046de38e6f9edf03bed24f039a6d054a29aed4951762
- SSDEEP 96:yoQGbu/vta8ksNuLikA70kfj73dteDNdxpCueczNt:af/1a8buLi3eDNdnCPm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  DamBho.dll
- Size 31KB
- SHA256 a391a059943274d82a89dc0eb069a57f8984c56cb3c4cded13388d4873985f16
- MD5 2cac7bdbcd895a3b2216fbff08f87799
- SHA1 ae20d356c897fa271a712a429ea7368cf379c55c
- SHA512 13937d63facaf2c661dde15b456cb0c062712165acf9054171f3a47711eba78729d83ea54bf55e443bd55c83478660ffb4c49bb2a28a966bb30ca4eeda934dfc
- SSDEEP 768:gIYSKiHRbUxF2hC9AZHHwIp5ByQisriWh5:QGRbBKAtH1KQisriWh5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  DamFirefox/components/DamMz.dll
- Size 89KB
- SHA256 d1bdf68eb4f0f0f5728f60715e96bdc1b86378de46f047a2f2e956b59b3a4055
- MD5 0627cc328c35b676a621bc5dd5652c54
- SHA1 b31f347d8cba9995790d6d133bd1d2f917b8a5f3
- SHA512 49590935459b5f53ee360566509c98b86504f5cd6d1130076864450d7a50c4b46d85c343a8ad7ebc0806870bf8634510d04a79754dddd2fb15517f650241c820
- SSDEEP 1536:EIcgJQmIbcO60MYyYjWg2G2jEasHS43oRD7dmVe:ETIbJlrgp2jKHS43oRlm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  DamFirefox/components2/DamMz.dll
- Size 88KB
- SHA256 28cb7431134c936aa718a1eb8d1a4d1c024819ba4ccd31cc8fc00597182a14b2
- MD5 7f5c21afbcee02b57851a101c0c308de
- SHA1 353aebccb24988942ebee69c847fc255d72e046a
- SHA512 7d3ba4d0b487366f21d174a02533b9132108dd296661e043beb6b90ef1afd5ec4653543e09e2c0d57d05973737745741619908e3a3cd90cafa1d31cee07f0b43
- SSDEEP 1536:V7lCwCmNHkkt16U3+20m96SSH3iFRBA/:VBzhZ420m96XyFRG/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  DamFirefox/components2/DamMz25.dll
- Size 25KB
- SHA256 0a28393fb6c9c19ab16aad595f36714fa40039528e1d1f52f56b550b85e7f6f9
- MD5 4a234889ef003c0e3bb5821e64c3f6c0
- SHA1 d8e5e611b95c5a8fb05c9e2d04f0f66472c3765f
- SHA512 62b6b6eb148272a7e6595f7f5aa489587cc0ab75f9d0ca8071331b9a51c46911917a3da6636c290625dff018e5f5e7b90d52a2e2142eddb8cf235bcf005f5dc6
- SSDEEP 384:Rj8saJw/JpnGGVgp64HvwGXsSyKuxbAvTpvP3eNgUkGHflkImBBxQOZXOPVgTIgI:RUvwmWCvkpfWP8OZXOd0IgI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  DamFirefox/components2/DamMz26.dll
- Size 25KB
- SHA256 39d3ba2cbb33c5c17e4152060cf0da06d931384ea9f9886ba753064187abf695
- MD5 54226a2afce74522824fa6bf50bf9be8
- SHA1 4204a619f975d4f3140c3a438794bde498c4ec0c
- SHA512 6efd6ab10940f0b37b859d2e5143966c6485aafc117e67e6728620446494a6880d44b626445d03ce0b50ab2993688b9fc4f56430ed5da1608aa190b22b0fdbed
- SSDEEP 384:JM86ZdsRJnsKhYnK4HfjSP8Si6rSEPDpvP3educUUGtJnuNRgI3gQOZXOPVTFI/s:JyfjKbvxZneRZOZXOdBI/s
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  DamFirefox/components2/DamMz27.dll
- Size 25KB
- SHA256 0611356b149563c75f9779e3e9cd3d0aba67702a7838bd463b93589b8ebcfb80
- MD5 34333f3b88330254aba3b32bae10204c
- SHA1 a9f6a4eedaea9a1534fdfbba4619177711243be6
- SHA512 aac9704c58391e64c65e2c271e85fd689ac3faee0442880e65984b3cbbc31ff3ba2287ae7a4b0a470c17196b0930842007d9a3842bf058abc4c3e46689f41928
- SSDEEP 384:6M86ZdsRJnsKhYnK4HfjSP8Si6rSEPDpvP3educUUGtJnuNRjI3gQOZXOPVT0I/s:6yfjKbvxZneR+OZXOdAI/s
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Registers COM server for autorun

Checks installed software on the system

Installs/modifies Browser Helper Object

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32