Resubmissions
21/06/2025, 07:05
250621-hwqhdsxnv6811/02/2025, 03:29
250211-d16myswldk811/02/2025, 03:24
250211-dx9v7swnbw811/02/2025, 03:18
250211-dt1hcswme1811/02/2025, 03:00
250211-dhpxgswlax811/02/2025, 01:29
250211-bv85satpdq811/02/2025, 01:14
250211-bltnqstmgr810/02/2025, 23:56
250210-3y8f7sspdy810/02/2025, 23:39
250210-3nh4kasmes810/02/2025, 23:26
250210-3e57qssjbj8General
- Target mozilla.zip
- Size 353KB
- Sample250210-3c3c3askfz
- SHA256 c85a87adee4c099081c0be6a69d7468280f4d289bde882c66af86d023d32288a
Malware Config
Targets
-
- Target mozilla.zip
- Size 353KB
- SHA256 c85a87adee4c099081c0be6a69d7468280f4d289bde882c66af86d023d32288a
Score1/10 -
- Target mozilla/ACCVRAIZ1.crt
- Size 2KB
- SHA256 04846f73d9d0421c60076fd02bad7f0a81a3f11a028d653b0de53290e41dcead
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/AC_RAIZ_FNMT-RCM.crt
- Size 1KB
- SHA256 aa18ea4c9a8441a461bb436a1c90beb994ac841980b8fd62c72de9a62ddf8ae3
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt
- Size 904B
- SHA256 8e3f237813d3f3e2f5767bc2a694a7557f84bb79fd60ef1adc25afd0c1fc5ef6
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/ANF_Secure_Server_Root_CA.crt
- Size 2KB
- SHA256 efb2df6e0075fa74e448077e402d171851b2ffe4668a614adc00dcbc75633afd
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/Actalis_Authentication_Root_CA.crt
- Size 2KB
- SHA256 c6d25347727f267774611677588d76f8a54a6e14d3e99dd69ef2c20612ed87c5
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/AffirmTrust_Commercial.crt
- Size 1KB
- SHA256 7108110fdaf19e3e5a7ed8fa38557248e79fe78bb2e9eefe7a0bb801cbfd2db7
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/AffirmTrust_Networking.crt
- Size 1KB
- SHA256 b68109f50ba0abed3b938afebd2ab42a2f5089062c59e9fc74425e2742d894bc
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/AffirmTrust_Premium.crt
- Size 1KB
- SHA256 94c88202bf2c13c68b90d124f93f62374f36776b0bfbc110c6d06f829290b580
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/AffirmTrust_Premium_ECC.crt
- Size 753B
- SHA256 42f0e946149ae0e0c6a1fb0e33150ce863479b2ef7b3c700161102ad1dcb34c1
Score8/10Blocklisted process makes network request
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
Drops file in System32 directory
-
- Target mozilla/Amazon_Root_CA_1.crt
- Size 1KB
- SHA256 2c43952ee9e000ff2acc4e2ed0897c0a72ad5fa72c3d934e81741cbd54f05bd1
Score8/10Blocklisted process makes network request
-
- Target mozilla/Amazon_Root_CA_2.crt
- Size 1KB
- SHA256 a3a7fe25439d9a9b50f60af43684444d798a4c869305bf615881e5c84a44c1a2
Score8/10Blocklisted process makes network request
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
Drops file in System32 directory
-
- Target mozilla/Amazon_Root_CA_3.crt
- Size 656B
- SHA256 3eb7c3258f4af9222033dc1bb3dd2c7cfa0982b98e39fb8e9dc095cfeb38126c
Score8/10Blocklisted process makes network request
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
Drops file in System32 directory
-
- Target mozilla/Amazon_Root_CA_4.crt
- Size 737B
- SHA256 b0b7961120481e33670315b2f843e643c42f693c7a1010eb9555e06ddc730214
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/Atos_TrustedRoot_2011.crt
- Size 1KB
- SHA256 79e9f88ab505186e36f440c88bc37e103e1a9369a0ebe382c4a04bd70b91c027
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
-
- Target mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt
- Size 782B
- SHA256 970d70366b2f8c29ac71c8f71689ddd8fd321208a5ededbb2d784af33799a0f6
Score8/10Blocklisted process makes network request
Downloads MZ/PE file
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1