e6c6bd02fa5f256653f81e8a8ef13fabfbcc0ba75a1ee41a83afb2199ea11d57

Sharing

Copy URL

Twitter E-mail

General

Target

df0b07f04985180c92145e6c0dc094f4
Size

3.5MB
Sample

240326-nhgk8abg81
MD5

df0b07f04985180c92145e6c0dc094f4
SHA1

0fddec2a04a90f383e8ce6cda6b91567649dd046
SHA256

e6c6bd02fa5f256653f81e8a8ef13fabfbcc0ba75a1ee41a83afb2199ea11d57
SHA512

d759574710d66098ecec3210c29c36439cf8e6248abba5426dfbc9b0422257250c4386e9b1047eb2a4c8a6dec82b4f66a343a7d5eb3e7793331378754f7216f0
SSDEEP

98304:ysdEHG1jhlRi51c+v24cacgIOGhgYForbxKjhYlQCqM:kGjAckrMy/ci

Score

7^/10

adware stealer

Malware Config

Targets

- Target
  
  df0b07f04985180c92145e6c0dc094f4
- Size
  
  3.5MB
- MD5
  
  df0b07f04985180c92145e6c0dc094f4
- SHA1
  
  0fddec2a04a90f383e8ce6cda6b91567649dd046
- SHA256
  
  e6c6bd02fa5f256653f81e8a8ef13fabfbcc0ba75a1ee41a83afb2199ea11d57
- SHA512
  
  d759574710d66098ecec3210c29c36439cf8e6248abba5426dfbc9b0422257250c4386e9b1047eb2a4c8a6dec82b4f66a343a7d5eb3e7793331378754f7216f0
- SSDEEP
  
  98304:ysdEHG1jhlRi51c+v24cacgIOGhgYForbxKjhYlQCqM:kGjAckrMy/ci
Score

3^/10
behavioral1 behavioral2
- Target
  
  $SYSDIR/Nicolas_Sarkozy_Screensaver.scr
- Size
  
  3.4MB
- MD5
  
  c873e406238a8aa456d4fc0cecbca759
- SHA1
  
  b3b7c97b9615b7b879a4c875bbd8d034ca637f5b
- SHA256
  
  9df92a772cdb4406f96e35346c4f45d96c5e06472785e018e6378c1865b2e1b6
- SHA512
  
  e23bf2696238b775a46eaf5cf026bba6846befe9de84bbb36ddfd46b42c016dff1c0a8c21bfb47b29edbb15ca25bd28c43c2f413a786c1c0664666aeeb6beda0
- SSDEEP
  
  49152:HSza2TROr8QGvfthfrrLDdW9oOpLEz1AolAKtKzOJz9VTvuBHDDW3qC1eK:H6u8Lv7rnDdpnFzWu311eK
Score

3^/10
behavioral3 behavioral4
- Target
  
  $TEMP/dospop.exe
- Size
  
  437KB
- MD5
  
  b2347a5c2350b6342cdabda956618759
- SHA1
  
  f6a779efafcf4bd6a9e1f8bf2c66af33f140622e
- SHA256
  
  9240b45f226db49da56c7b12b7a347eaee578cfc0e4603019091a1fd81bfcafb
- SHA512
  
  76468bda8a4e0df0bf49efdf6cf96d3f45a85db73540e066cc156ca0481d676606d46f3b98774395914c4f357d752c9bbae6e41f9277bc362dd712bd430eda04
- SSDEEP
  
  12288:WGeC/oEjVcYKKrh/RfKum6YGBzz9QJWCqoRFf:8CNjVcNKrnVm6vBzBCqoH
Score

7^/10

adware stealer
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral5 behavioral6
- Target
  
  /tbu03344/RSSReader_plugin.dll
- Size
  
  260KB
- MD5
  
  131fa8aaa9f5e717477d6e16c6f8fb70
- SHA1
  
  17e50467e224d7461c46a456442f10a0da3cc7ec
- SHA256
  
  efb9b1707ca2447c63036b1074c402f8ff6a5f30441c03ea372d1f0ec8423bc5
- SHA512
  
  d87a6789aec7574c4888e4a6da3c7776e937b62ab481e2aa874752d71854b32a9ad2814321cb24da1f1b134e3b443be4474fbfb09335e06349862151beccd32e
- SSDEEP
  
  3072:OoqSEB35vhDI5+crn7CAjtjJ0voNZmDlny+sSy2EjJqP8InGnhIkIoRQc5ciab/W:dEB3QrCgOvSmD1TBEleGOkPWe
Score

1^/10
behavioral7 behavioral8
- Target
  
  /tbu03344/content.tmpl
- Size
  
  304B
- MD5
  
  80ba40bb56e55f81154073497011785e
- SHA1
  
  b3c465dd09afed93e7a7ef6473a329f4c0ca2ccf
- SHA256
  
  d069903c72eb22e8b2a3b581e579796df3750e902d2428ed4cb39882891a0d1a
- SHA512
  
  f6fbc20ce71a66837b4aa33e5c7af0ade8229290efcb3a2d4e8fd3680de7a3ee33312baffda9de62906f40bce6386c7e148ec0e572fcf5f1a8489b0ebb31b6c5
Score

1^/10
behavioral10 behavioral9
- Target
  
  /tbu03344/dospop.dll
- Size
  
  872KB
- MD5
  
  c97179ba4ed0491d227335ffebdc856a
- SHA1
  
  6de5da7bf23ec5e519a9068817cd26890c1a8930
- SHA256
  
  7e333107d1b5d943b9ad2a52625b02d28d79be60734e2d77a8ed2c7335214632
- SHA512
  
  bc2eb7c9c939907e7390530722b722aefc7e59a06d59187d9cbb9b9678d2209f484d53b0e3c22337026c4ae6b8c619a53ccd0505612f5ab6b456ec204a4b2265
- SSDEEP
  
  12288:JbJRJfYLE7U0n/y2xVlZcuKFAejQD48mCJon71dEMcSbLn3BghuL2OT31YzsPzXh:JVRJfCEw0nq2xVtKFApY5v3+19e
Score

1^/10
behavioral11 behavioral12
- Target
  
  /tbu03344/marquee.tmpl
- Size
  
  1KB
- MD5
  
  1cb103dabfc25402a01957b9eb04f948
- SHA1
  
  da250b475bfb386b1741805bda18fbe6e1ae9282
- SHA256
  
  5dd15a2ba1b7b646b1ca35e13ea9ae6c5f3fd5ccfa0480c0070a9b9bf59d477a
- SHA512
  
  66441e7796cb87eba88aa2b9493f8dea5371dbe045a5f4bfd45a4d9922fab9e0f5277819c0d11d7d561389c75edb1f9b9002439829a13406b92f46fbfd85d2f7
Score

1^/10
behavioral13 behavioral14
- Target
  
  /tbu03344/options.html
- Size
  
  6KB
- MD5
  
  adc6e16ce6e97bd1eb19d3a8dad7274f
- SHA1
  
  12b55eab3225b2250ba051803f7d791db59a46a1
- SHA256
  
  29e525a91d8ac4ec6bb2fa299a404d9f151b45400c7cab09675a23469373435b
- SHA512
  
  2c4bc233ae8741fe0a6995845aa88d707b347cfc78745fefac346ce27ddd5b799dd374bbba15516f6e61348f52720be3639cf0cd925a599250a9947a33ab7103
- SSDEEP
  
  96:BKQ/O9mOdYCQiLFyzNYs90Yi67mX9gPui39bnLNza7/OBgx4wTn:BFj1cFUYJYnV6Bm8
Score

1^/10
behavioral15 behavioral16
- Target
  
  /tbu03344/static_img.html
- Size
  
  503B
- MD5
  
  2caff3519f5be538757c467d4fec4756
- SHA1
  
  7e77344f049d9ee4d216b6f412c01ba28596773c
- SHA256
  
  e94503ad0ea2a4f7002ba70f57e12da9daabb5037b6bedc7725d1fc43a487415
- SHA512
  
  029814dd117053d03acc6c0cb1af2802256149c6a3588cd41334deeffad6095dc16386887e2053f288b13a5ebd3599cbf9c55c194fde81f3df77045d2609a467
Score

1^/10
behavioral17 behavioral18
- Target
  
  /tbu03344/static_pub.html
- Size
  
  599B
- MD5
  
  0bf3de7de6f6a9ece7674fb245c7e428
- SHA1
  
  a71d601820676d5741734e825c7347d59570bc98
- SHA256
  
  29101ddb9fc880b921c78a8aa0952310ccf0fe4eb03479425500fc2e779d4b2b
- SHA512
  
  30dc0cf67d772a79dec244882f24c4a6ad71a3139b1b92d6e059f1e677ef138596e71c7bf12c2283b591ad64744b9abd15895fa29c4a600f64c784423bc270b2
Score

1^/10
behavioral19 behavioral20
- Target
  
  /tbu03344/tbhelper.dll
- Size
  
  180KB
- MD5
  
  bd60d9ff3cfc8ce202063f75eb817780
- SHA1
  
  27f7e3d852ca84223f2a4b48a5a6f8fbca11dfbf
- SHA256
  
  3f56aa185c36a69557a87633def1b291bc7e61064e4ee51483e7b6a2659bb51c
- SHA512
  
  2946d94e697d02c6d25e9daa7b7f18430a6ba597f9f0ce082296b57e28821d2199aab92ed14c58a95a2fa80824c800ab968fc88797d0f0cf1839befb04518155
- SSDEEP
  
  3072:063enkjfM0238ENyc0eePgN8MsSBTwMifOZUv+2jFoArAMsJg:0BiE02HePgCfswMiWZyl0Jg
Score

1^/10
behavioral21 behavioral22
- Target
  
  Uninstall.exe
- Size
  
  49KB
- MD5
  
  7805ecad1077dd8ac1ff28015a3b05e1
- SHA1
  
  693617b6cad16f97d9b61bc25a731ec71441ba67
- SHA256
  
  e3ddbd65eb5a2033141e577bb75ba3b71c5c18e8a0e9bb7a0b1cde41c4180dc7
- SHA512
  
  867e8f16424501935ed5df2b49d23854578a4d0f26791ad76b39893ffa434f65c665d9af965c888a629155e82fda5213e964796b3c4cf7995551ca36c842de31
- SSDEEP
  
  768:LbGBkj++ARXzxc2FdZ6IOw7UkfSy0D3DwdFkqsWkJd+eJRn5Am6kRRJ2iZ3igvHk:/EkjY1zy214Qay0DGkJYqAELVigvE
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral23 behavioral24

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Installs/modifies Browser Helper Object

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24