61784eaa99ea232c4005ea1a9b0b4f5a78c804267134cf4597b0ccf011c77b3b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

26586f4a13000cef487b0d155038d41c.bin
Size

49KB
Sample

240706-cswmcawajc
MD5

26586f4a13000cef487b0d155038d41c
SHA1

868684a0ef4201348dff25f6ada83c99a38590b5
SHA256

61784eaa99ea232c4005ea1a9b0b4f5a78c804267134cf4597b0ccf011c77b3b
SHA512

cae6dd72fe2071a4376a14f27e44c9184b769bd5fb40041f16301dd7854625af919833bd109c54aba8fb9b01003e8c3bd604768e84faedd84d710244940c1cfb
SSDEEP

768:NyjqmPvkbCqSdScrOS01bPzcolxKzZKl9YNlcPAZHVEYl0vF8FFwpUarprU0rYX:NBCFdNrOSyzcWK9EWNGPAdVERCPcULX

Score

7^/10

adware stealer

Malware Config

Targets

- Target
  
  26586f4a13000cef487b0d155038d41c.bin
- Size
  
  49KB
- MD5
  
  26586f4a13000cef487b0d155038d41c
- SHA1
  
  868684a0ef4201348dff25f6ada83c99a38590b5
- SHA256
  
  61784eaa99ea232c4005ea1a9b0b4f5a78c804267134cf4597b0ccf011c77b3b
- SHA512
  
  cae6dd72fe2071a4376a14f27e44c9184b769bd5fb40041f16301dd7854625af919833bd109c54aba8fb9b01003e8c3bd604768e84faedd84d710244940c1cfb
- SSDEEP
  
  768:NyjqmPvkbCqSdScrOS01bPzcolxKzZKl9YNlcPAZHVEYl0vF8FFwpUarprU0rYX:NBCFdNrOSyzcWK9EWNGPAdVERCPcULX
Score

7^/10

adware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2