c376d4b358dcc87c617ac68b257fb1a2a26baa2abc281ebb458e9d4ce20f4737

General

Target
OPAutoClickerMac.zip
Size 532KB
Sample240628-brag2starc
SHA256 c376d4b358dcc87c617ac68b257fb1a2a26baa2abc281ebb458e9d4ce20f4737
MD5 c7989ca5a20d77cde17945d7b73c3f08
SHA1 5db5ebd6b92a1414c88d2712f1b942c383017c5e
SHA512 48edaa4ca53a47211095663b32745d802378d85cd6f64f63331e816b8568379e1c62db6fb857254042b1300b4ca84cd5333f98e3ef333ca3c3cf4f82f0e18592
SSDEEP 12288:T1k6aEJyjrOjR0GzYSJVZ39pVWOsNrVyD8egWeCqBBFJUxF:TO6aEojrE0G0y33fEOfYeCCqBv23
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  OPAutoClickerMac.zip
- Size 532KB
- SHA256 c376d4b358dcc87c617ac68b257fb1a2a26baa2abc281ebb458e9d4ce20f4737
- MD5 c7989ca5a20d77cde17945d7b73c3f08
- SHA1 5db5ebd6b92a1414c88d2712f1b942c383017c5e
- SHA512 48edaa4ca53a47211095663b32745d802378d85cd6f64f63331e816b8568379e1c62db6fb857254042b1300b4ca84cd5333f98e3ef333ca3c3cf4f82f0e18592
- SSDEEP 12288:T1k6aEJyjrOjR0GzYSJVZ39pVWOsNrVyD8egWeCqBBFJUxF:TO6aEojrE0G0y33fEOfYeCCqBv23
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware discovery evasion execution exploit persistence privilege_escalation spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Possible privilege escalation attempt
  exploit
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Legitimate hosting services abused for malware hosting/C2
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1