153a21844ea08dca1f61f091c26cfb5eac91d46e1b9a378d43a767669b6cf148 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
153a21844ea08dca1f61f091c26cfb5eac91d46e1b9a378d43a767669b6cf148
Size 634KB
Sample240414-xtx7saeb4y
SHA256 153a21844ea08dca1f61f091c26cfb5eac91d46e1b9a378d43a767669b6cf148
MD5 3938054c5ddd016f76661221da8785ee
SHA1 4c55d9008267ce44a25e4d1503c1754eaf5ba5f4
SHA512 66e353f473f35c1d0bf48cb8ca568ea5bb415173de2933aa94e31e4df57b767550b5677135482b3fb1724774a219caba381a040839d61c5506d2e6f9c31d33aa
SSDEEP 12288:6uCG4GjeZHkwuPikQ7lKH5p5H9x1SeZHkwuXiZQblKh5pDxXTd8zbf:6uCG4GjeZEXi37l6Br1SeZEviObl2rlY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  153a21844ea08dca1f61f091c26cfb5eac91d46e1b9a378d43a767669b6cf148
- Size 634KB
- SHA256 153a21844ea08dca1f61f091c26cfb5eac91d46e1b9a378d43a767669b6cf148
- MD5 3938054c5ddd016f76661221da8785ee
- SHA1 4c55d9008267ce44a25e4d1503c1754eaf5ba5f4
- SHA512 66e353f473f35c1d0bf48cb8ca568ea5bb415173de2933aa94e31e4df57b767550b5677135482b3fb1724774a219caba381a040839d61c5506d2e6f9c31d33aa
- SSDEEP 12288:6uCG4GjeZHkwuPikQ7lKH5p5H9x1SeZHkwuXiZQblKh5pDxXTd8zbf:6uCG4GjeZEXi37l6Br1SeZEviObl2rlY
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home2854chaction.js
- Size 834B
- SHA256 cdd834ae5537e859b1d98d07be0aa593918f190438e4c2a933c445f0c293d3d9
- MD5 4a293e2047c1730261debb64e23bd0a6
- SHA1 63f4213e32b064a320cdcc796db45eef5b7477c0
- SHA512 616641515de2ec97aa0fa34374f3830fb82234c6169429fbc35a50d8bad30a6a20a513981222792e0d6ae8178b341c0591745f81fc526d5770a3c07e12a8adb3
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home2854.js
- Size 747B
- SHA256 2ce9e10a6ccd3f8317b9e695431de64adc9b83144ea6e428f21ba8c9a0d5dab5
- MD5 1caf516003ea598d93264774a31f66e2
- SHA1 0d1bb940b83637f3470e538af0e5fc745c3fd9be
- SHA512 698e7c4eeeea2766e2f3c069b2e64849fe463498f278888596d63cfd25d859a35cc9f2d6599bc8c7f99e2e2922b5220e6bb210c430d17450bc253581f024396a
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home2854ffaction.js
- Size 678B
- SHA256 212dbe6781fc427ac8e58d2bfb2f89835e5e0a647809ee44ce9982a15b327ab1
- MD5 f08040d1a8f9a88b9dd0222036ac2d64
- SHA1 26350947014100e5a0e1dd2b22893e66f3b35995
- SHA512 ec12f1e9085d1aba93a98907f17859ad1049747e1348bf3f41c3cc2769dadd69586efb4f076efcdd333da3e96935fab6b65ec8e6269b0b895fc59d2116075d51
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home2854.dll
- Size 85KB
- SHA256 81ebd5b5c8ee4d8a7fd96556653c2c5d6de3a91586e0840a03df93378f9793f3
- MD5 30da403a8658d0c19235e2e7ae696a44
- SHA1 01950646830295e694c0d7d9af764efe51ebdeea
- SHA512 8ee9f93c0b5bbc7be27dab4877dd245f49f8cf5205b6f805a55826043d5e304e755fcc6c8aca5efb7cdb667d03906cd50c8e3226bff94977a5f570d1d4ed06e6
- SSDEEP 1536:48/1CsEmka04RhRtahrOb8DkhWDHA9glQZJa5:D12mka0ElahrOqDguaZJa
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 361ba3e94cac8ffad333d3e895f632e98d0a5acd620eec067b3a3c7abdfc21d3
- MD5 e6543c6d41de18ab838bf66d4d1e917a
- SHA1 0c97b6daeaf4902a363a465d3b4396634fc256ce
- SHA512 a9c06d27e9fd837d004cfe51cc8d0c8adc613be16208b338aff1b56cd964463de990f7b7f4ab333c8aba05d8e338ecf28812f036184a9a24a389fabd56e275f6
- SSDEEP 6144:Ee345tpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1B:8LeZHkwuPikQ7lKH5p5H9x1B
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16