Resubmissions
21/06/2025, 07:05
250621-hwqhdsxnv6811/02/2025, 03:29
250211-d16myswldk811/02/2025, 03:24
250211-dx9v7swnbw811/02/2025, 03:18
250211-dt1hcswme1811/02/2025, 03:00
250211-dhpxgswlax811/02/2025, 01:29
250211-bv85satpdq811/02/2025, 01:14
250211-bltnqstmgr810/02/2025, 23:56
250210-3y8f7sspdy810/02/2025, 23:39
250210-3nh4kasmes810/02/2025, 23:26
250210-3e57qssjbj8General
- Target mozilla.zip
- Size 353KB
- Sample250210-3nh4kasmes
- SHA256 c85a87adee4c099081c0be6a69d7468280f4d289bde882c66af86d023d32288a
Malware Config
Targets
-
- Target mozilla/GTS_Root_R1.crt
- Size 1KB
- SHA256 4195ea007a7ef8d3e2d338e8d9ff0083198e36bfa025442ddf41bb5213904fc2
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/GTS_Root_R2.crt
- Size 1KB
- SHA256 1a49076630e489e4b1056804fb6c768397a9de52b236609aaf6ec5b94ce508ec
Score8/10-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory
-
- Target mozilla/GTS_Root_R3.crt
- Size 765B
- SHA256 39238e09bb7d30e39fbf87746ceac206f7ec206cff3d73c743e3f818ca2ec54f
Score8/10-
Blocklisted process makes network request
-
- Target mozilla/GTS_Root_R4.crt
- Size 765B
- SHA256 7e8b80d078d3dd77d3ed2108dd2b33412c12d7d72cb0965741c70708691776a2
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/GlobalSign_ECC_Root_CA_-_R4.crt
- Size 704B
- SHA256 d1b69887f73444c0fc0a6f22a2fe961c2423275f9c38ba7d50da2a4ba75394f1
Score8/10-
Blocklisted process makes network request
-
- Target mozilla/GlobalSign_ECC_Root_CA_-_R5.crt
- Size 794B
- SHA256 80eeafa5039f282345129a81ace7e1c1e1d4fd826f1eb3391a4ea56f38a6e3d8
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/GlobalSign_Root_CA.crt
- Size 1KB
- SHA256 df68841998b7fd098a9517fe971e97890be0fc93bbe1b2a1ef63ebdea3111c80
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/GlobalSign_Root_CA_-_R3.crt
- Size 1KB
- SHA256 6bdc59f897631af7811e3201cbc58e5999de2600ae8667454a34514eecfd8381
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/GlobalSign_Root_CA_-_R6.crt
- Size 1KB
- SHA256 5ff8425be71c1805446bf10601ce3cb9619889866766fc9285583ca5a4a7de94
Score8/10-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory
-
- Target mozilla/GlobalSign_Root_E46.crt
- Size 769B
- SHA256 5bd16128d0934629c2e1713140a6f97c9828dbb5429ab5797b2573efc71de1a1
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/GlobalSign_Root_R46.crt
- Size 1KB
- SHA256 dcc1a6246e13880ca5b73ef547e082dd0401e4d8837b6d211be82f7be791ac65
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/Go_Daddy_Class_2_CA.crt
- Size 1KB
- SHA256 47f15a52a984ab1f9cd92b6c1849c0465c1b3c9c6837d54e5d2c004fa01b69b7
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt
- Size 1KB
- SHA256 500329abac100a953a7396b54b36be57d333022f17401bc948248ea179cf1784
Score8/10-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory
-
- Target mozilla/HARICA_TLS_ECC_Root_CA_2021.crt
- Size 867B
- SHA256 c6dc63e98b3a5e6a595c7d583a9c47c5efb6d316957466fd16c785b423eacf37
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
- Target mozilla/HARICA_TLS_RSA_Root_CA_2021.crt
- Size 1KB
- SHA256 05e0ebf9643197ccf8036cdd86a2ee14292c2a077dbe06435ed30369b8762564
Score8/10-
Blocklisted process makes network request
-
- Target mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt
- Size 1017B
- SHA256 1cdd90d42b48cced8f5ecbff087c49da56b224f0272e4b5074e63b82fff5fb16
Score8/10-
Blocklisted process makes network request
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1