1dd5bf67d2f7e0fc2e95baf84a8bda494668ff304fc6bb910b1c0d58d5a85bee

Sharing

Copy URL Twitter E-mail

General

Target
1dd5bf67d2f7e0fc2e95baf84a8bda494668ff304fc6bb910b1c0d58d5a85bee
Size 6.1MB
Sample240610-czzmksbd97
SHA256 1dd5bf67d2f7e0fc2e95baf84a8bda494668ff304fc6bb910b1c0d58d5a85bee
MD5 ae7cdb52b790211493266749e587370c
SHA1 e7f7a140a995b297ce1d8937c4395b4e9a26e45c
SHA512 4c87a54a733423975bd8ac6423e9f0b4cd94116ef8c35cf6d31cb3a98247fdb9a9d1fe84595efecfd76271b8241d04ed0446525cd465978fe29d3185d60af8ab
SSDEEP 196608:SjQEXTq80FWiobfAa8DNFNFXwlYQJXBWlV:SjQSYF6cNFXwlRM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Targets

- Target
  1dd5bf67d2f7e0fc2e95baf84a8bda494668ff304fc6bb910b1c0d58d5a85bee
- Size 6.1MB
- SHA256 1dd5bf67d2f7e0fc2e95baf84a8bda494668ff304fc6bb910b1c0d58d5a85bee
- MD5 ae7cdb52b790211493266749e587370c
- SHA1 e7f7a140a995b297ce1d8937c4395b4e9a26e45c
- SHA512 4c87a54a733423975bd8ac6423e9f0b4cd94116ef8c35cf6d31cb3a98247fdb9a9d1fe84595efecfd76271b8241d04ed0446525cd465978fe29d3185d60af8ab
- SSDEEP 196608:SjQEXTq80FWiobfAa8DNFNFXwlYQJXBWlV:SjQSYF6cNFXwlRM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 40d66e085409445202dce1b5419449cc302d91be17614b521e3ccce473205db7
- MD5 d7b3f05ff44116b9080b5e69b2e86efd
- SHA1 2535ecfa122041edb901ac667944e0f6814c4cd0
- SHA512 414c6b410b35a8bb5a2c9fdd46dad63704484e1535155219b29a5bb886ded73f4b7ca3bafa726ce751e1c711a764938c9256106a90098263d6ff88bc017ec140
- SSDEEP 192:X6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTyK72dwF7dBdcQOz:X6JaVh4I5rpPbTy+BdhO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $SYSDIR/msvcp60.dll
- Size 404KB
- SHA256 bf645eebea6f0591dcc5ab1afc17b62cd476d83e4b2fba44c060a9e3604e40ac
- MD5 1f57eb5b92b2ac7f9d71a77d184d8c13
- SHA1 c067f10ba008ec0d6097bb447b7121e7c17f87c1
- SHA512 36f80ab01e68455c20cfe2fdb8a78a2e0d78749e668ff2b6bc5e1f2eb53527484113531b4f9190788cf6d5cbfd852f2d1f2757f742968ccd8319bef3827728b1
- SSDEEP 6144:8YPRpy9PGw2H09lQEGpX+3OoxHkC30+fXReo:8YPy9RQuCnpX+3OoxHkC30+peo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  AyuConfig.exe
- Size 28KB
- SHA256 911965eb61fe4433c99f17792e1ab4a16953f2ea4be6c45d1fe3707f5f2ddbd4
- MD5 1672b5483e7459056f28e9174603b8d4
- SHA1 ae98997d413247796532c1631aa231cfd0c98802
- SHA512 45364e3dce9f528b1ff7f75368ad22ee2781d1de93c00fdb1d8c4729c48869b3cc24805ec8f8690b898b678aafb9b0abecc1db3e56cd0bc04eb94b964f9f1c82
- SSDEEP 768:8Q/LUD5wQDp3AYZgeNOwNOC3MLvrwJ1u8InygJ:zUHaeJM8OxFJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  ComDlls/TDAtOnce.dll
- Size 173KB
- SHA256 77e4a0a21ab80aca7a98fd31af8ba57fcaceef0dcb206b0ffcbd102ed1276874
- MD5 a4800a943cf9664b8650ab295aea83c7
- SHA1 7ee3f09a21bbb2bf7b6f14a0b157990035168d9b
- SHA512 fed8a0d884127c8cc582aa5b0994e1916d69425479a05a9bdbf158fa7f2fa1fc9ba9622feca0d279a4a8b377f2bafabd52075ad7bfc9ad982fcc2a60b4fd09bc
- SSDEEP 3072:eKRhsGgyGJuOcDDw+80BUOtpxcY1zP+j0rrmnjLrpa/3lLKScFxlAbzjSTo:lhPGsnF9cYrrrmjPMBUlA/jSs
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware stealer
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral10 behavioral9
- Target
  ComDlls/ThunderAgent.dll
- Size 104KB
- SHA256 05a04a7d8057c1f9d1fc250b5bfa67258a3ed3475d7cb5898ac01238334abb76
- MD5 b6ac7d7f342f81f827cf7f07eb6c0d16
- SHA1 8305c41c1eae7d728cfdaa1f49ede5fef77261e6
- SHA512 8642a874f17d0534a895338ce0b18fbfb4519206d339ce9292eb3186de6ceccf52f907ece356dcec3588cc52cefad4c66104f53a47c8f5ab93c17e8516d777d8
- SSDEEP 1536:XiUB4olTayQYliO8WFvQxVlT9Eds0uSB5Tp2CchDlGV8joTYyQXV:Xib6bQYNvQx+oSXTpnkDlGV8nyQF
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
behavioral11 behavioral12
- Target
  ComDlls/XunLeiBHO.dll
- Size 193KB
- SHA256 b574ca8bc2d8c97716ccfe7a2629ba035577eeb4c45a0882ced1f5fa08c5330b
- MD5 0ce577e907c45ec8337be8e2a02c69aa
- SHA1 0726ab3d0f1433626aadbb9e2996fc18dfec0402
- SHA512 9dda369a9fc764754bff8e7c2a8cd5d2060b2aec8372ed15a52620af366ea10cc46f686c1519872472d7fdbbbd8b2a7a2050b433abfa893774918fc28438e4a1
- SSDEEP 3072:6e8ltJ43dTzjFARVDux/EYkK3F1Ld31mM6yZIp+rnJJalJBziU:6eOtJgdTW7uuBKjdFmlacKgL
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware stealer
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral13 behavioral14
- Target
  Components/Community/RichObject.dll
- Size 244KB
- SHA256 358b41b0fe925adacd2883e9ab42c7780cca95a06ae953589cf04726ab923dc6
- MD5 a5262bdc8ec64c0d33a156727465557d
- SHA1 1b2960f99cc6d8f419f4742a09951533402eb9c7
- SHA512 51a57f2469ad3cebedf513202d1976b414a58b2d8c8bb06c64adf8694f565d0ecebf2c7907f1219e0309c76afd92b50ba24723d0ef186e4f1602432e5bef544a
- SSDEEP 3072:iTA+Zn+/uGmLerm1FlxLPjdHWXjRbJuGWLYeNYbt4mMC3agQTBfXAg0FuEfwlUoG:ih6rZYjdHW1bcibtRvqgQTBvAOU+O
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  Components/Community/XLCommunity.dll
- Size 1.4MB
- SHA256 06d30295310777866a3139d625f75d4c2a39a73ed5ecf980d59eb83faa178943
- MD5 bc8342373552c1b7b1df8009a9250ca8
- SHA1 1e7922b6c30a850ea9c369cdb2b000a289ee0420
- SHA512 abb92e69cca1778a03393d3c7563709912343bbec1089eb78a918a23cb17fb8521112cde929467bd828f8104659321de1b54bcf53ec9717ed1525d86cf39569e
- SSDEEP 24576:CqUu1OC+h17qoB1hijnVDYDnXSG3jNIsen0LCxT5ZTnPa7C6:CqUgVoBbCpYtzNIsqewTDmC6
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  Thunder.exe
- Size 44KB
- SHA256 00f05ed9a6ac19b074cffb1f0e695d5c4c0aede8a0fb4555abe43972efcfb41b
- MD5 04a62742f5091b3477c2c76ec71e52ac
- SHA1 d15f8272ab77c77b418a0048979918f53c4e298b
- SHA512 8c38d5071e26823d755395bb848e7d2ca4469d3d60b73e61c27f930aaaaebe53ced30fb4da8328f9a878349a16ecd9b9601d183d2e30d088188290bcaccabd58
- SSDEEP 384:/9mUuu7nkK/v0hs1kU1Hc3AYP4Ni1Qs5UdI+4yLw4yfh4yyseLjR:EuLkqchs1u39wU/UJo1yPL1
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Installs/modifies Browser Helper Object

Loads dropped DLL

Loads dropped DLL

Installs/modifies Browser Helper Object

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20