049b5bbf54200dc0ad7378a38b4dcb8cb99ccd18d1f6cd7176fe294de49b1166

Sharing

Copy URL Twitter E-mail

General

Target
AOICMJIKNPCGKHGEOBPFALJPIDNNLOLL_5_3_9_0.crx
Size 215KB
Sample260706-ajabmsgw4v
SHA256 049b5bbf54200dc0ad7378a38b4dcb8cb99ccd18d1f6cd7176fe294de49b1166
MD5 b2d3cae9891ef2649f014a9fa7071549
SHA1 f85223a15ab2aede4d78154aae53aa6da5ef0fc4
SHA512 b45e3fc377282ad95c73455f3cd8c54e09869819b453733061504bbab1c6e70a29879f62b40eb854cbb3eb6e3d059de1086f9615594311dee59e17757c27d841
SSDEEP 3072:1LlZ3NNeNkWYcD4J73NqESTypeL5cvdCJQbJQBBd8DGH2hvZPkLxYs7nW:1JZ9wNkWzwqny8LqvdSWY8htZPklxW
TLSH
T19C24F11C2DE9EB52C48AB27969C6F843F45E8F6E22C75C1B3205551838F0B6C53E2DDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  background.js
- Size 2KB
- SHA256 f5774ddaa3a8c514b37e659d35e5cbe8549657f40bd9353e6f9de5daf9f3e06b
- MD5 029217a4f054469d2919bb4a27236fc3
- SHA1 7b52db09df10ab0af17c61c34e79fdf2654b2d3f
- SHA512 7459f1e2d085e2776bd747958c53c3ef5b74fd47aec65172a4d15f406e52454e3ff3b4c372239de99d3278210d4211754ec5156bcdd867bbf9df03a276ca8973
- TLSH
  T11551F00D344B78BAB81B0E7AF9B6408A6AB8026065B954336406DAF9DF7D54D014FF29
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  chrome.js
- Size 14KB
- SHA256 774173d76a6ad8d46af937f26c85cc955694be6365627dad94f28023105f66c9
- MD5 dfb21a379ab3b6e3f1d7d69877d53814
- SHA1 9e3f5b3bc22e3750b9524da51457d7f2db3e7bbe
- SHA512 4e621bddcbf67d87e3f84e91c73b88318fd435de14c0eebeed4cafdf7c6378b75ba34600f1c5b95fb1d79286145d14ccb633007e23001a06cfc33717d893868f
- SSDEEP 384:kkazGRNqaN70OLrTIrTrrbEDNf3iySClW4ve8:kfzGf3ErbESXx8
- TLSH
  T1A462A6A8B8F570B2407B64B1212F660A3276AC35ED198010E571C6F46DF8E4E7632F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  libs/html2canvas.min.js
- Size 27KB
- SHA256 f6ab6a6cf22a7c8e90c39a9c385cb7925b0849384c63114aa434bfa1e78bbf97
- MD5 ba101a2ae9ce3ca61274321ce54400ee
- SHA1 69a0c82e6cf4d432cafa0112be1715963c24a3de
- SHA512 756701ae96650f61e58da5cb626ff69560c4987e44de597bfd641ae38fe6bae3cba5e36e8b2aee14fcc7ea3218055706759af0eb2aab75f47718edde2984bc53
- SSDEEP 768:PrF8y+0CYXhUt5UbtC2PYy1WOTX7UXzpZ/31o8FCG:TWeCYyHUEiYy1WSrUXzL1o8FCG
- TLSH
  T1C9D20AA47226385FD1DA02DAA03F450EA131AD62A70BCDB04504D774A5BCCDA39FFFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  libs/jquery.js
- Size 86KB
- SHA256 b52b7222fc17180a70465aa2f1c36a384a79fd55f8ba9cc2bca626bcf29a3620
- MD5 425c7e71851071c46c6f167537528396
- SHA1 4e7b47a58278492e5d06b5362f629e81187f1abf
- SHA512 5d0a09d26e5940cf1aa1db22562729a4d8d551eba18a6e035818c69eeace5025fc1f98582fd1accb7da9bfadced3e21e0cfd47e6829eed91c74615919a26f006
- SSDEEP 1536:69zy20+ier26xeQ7YPuSmDBNtwcmVKm/7LRmV5EJuCAx72mL9JCuRtqdK7nV+gwb:KoEEJur72A9/RFEgwvD
- TLSH
  T1E68319DD72CAB06357A730B9506F510BF2765988784C8410F268D8E5FC78A4A827BF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  option.html
- Size 1016B
- SHA256 41f8af66cc86eb215d9841eda4f195494fda55ee92f795f8b543cf6986cea3df
- MD5 0cccbf4cb188291e0dfd42e88487ec3f
- SHA1 c98e09e95558660b6d5f536011176becbbe0c1de
- SHA512 a871afbd711289105862e9a086337b36ca1c138849b5eba1be0109e77c5bec35558a465420809277e31d3bfd13d3dc905ebe277d38fa3c31e3583de6f8422e61
- TLSH
  T1A4110C10F4F0B56A2623045E9ED299215F5D010FC9667880789DA5A8EFF8D8BFB171BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  option.js
- Size 436B
- SHA256 0c2b39c12ce08dc99f5aa4e673f4bbd88ae1566c30c29122b4b105246882d119
- MD5 5e7fd35fcae51520ea3783f691f99c03
- SHA1 0f75899984ef28b48baf869255474f60e2e8d823
- SHA512 5fe58111032a4663b908a02fe01d24e6586d50e681ae6bb35959a454238f92eb1d06f733b0b12de825c051a445b8365b89bb5f0b41be671f4ec6f8bbfd02d818
- TLSH
  T1DFE05C6966E122B01F3F09B75997614890780094AD21FCD10849DCCAEDBCD4CC347E5B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  background.js
- Size 2KB
- SHA256 f5774ddaa3a8c514b37e659d35e5cbe8549657f40bd9353e6f9de5daf9f3e06b
- MD5 029217a4f054469d2919bb4a27236fc3
- SHA1 7b52db09df10ab0af17c61c34e79fdf2654b2d3f
- SHA512 7459f1e2d085e2776bd747958c53c3ef5b74fd47aec65172a4d15f406e52454e3ff3b4c372239de99d3278210d4211754ec5156bcdd867bbf9df03a276ca8973
- TLSH
  T11551F00D344B78BAB81B0E7AF9B6408A6AB8026065B954336406DAF9DF7D54D014FF29
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  chrome.js
- Size 14KB
- SHA256 774173d76a6ad8d46af937f26c85cc955694be6365627dad94f28023105f66c9
- MD5 dfb21a379ab3b6e3f1d7d69877d53814
- SHA1 9e3f5b3bc22e3750b9524da51457d7f2db3e7bbe
- SHA512 4e621bddcbf67d87e3f84e91c73b88318fd435de14c0eebeed4cafdf7c6378b75ba34600f1c5b95fb1d79286145d14ccb633007e23001a06cfc33717d893868f
- SSDEEP 384:kkazGRNqaN70OLrTIrTrrbEDNf3iySClW4ve8:kfzGf3ErbESXx8
- TLSH
  T1A462A6A8B8F570B2407B64B1212F660A3276AC35ED198010E571C6F46DF8E4E7632F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  libs/html2canvas.min.js
- Size 27KB
- SHA256 f6ab6a6cf22a7c8e90c39a9c385cb7925b0849384c63114aa434bfa1e78bbf97
- MD5 ba101a2ae9ce3ca61274321ce54400ee
- SHA1 69a0c82e6cf4d432cafa0112be1715963c24a3de
- SHA512 756701ae96650f61e58da5cb626ff69560c4987e44de597bfd641ae38fe6bae3cba5e36e8b2aee14fcc7ea3218055706759af0eb2aab75f47718edde2984bc53
- SSDEEP 768:PrF8y+0CYXhUt5UbtC2PYy1WOTX7UXzpZ/31o8FCG:TWeCYyHUEiYy1WSrUXzL1o8FCG
- TLSH
  T1C9D20AA47226385FD1DA02DAA03F450EA131AD62A70BCDB04504D774A5BCCDA39FFFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  libs/jquery.js
- Size 86KB
- SHA256 b52b7222fc17180a70465aa2f1c36a384a79fd55f8ba9cc2bca626bcf29a3620
- MD5 425c7e71851071c46c6f167537528396
- SHA1 4e7b47a58278492e5d06b5362f629e81187f1abf
- SHA512 5d0a09d26e5940cf1aa1db22562729a4d8d551eba18a6e035818c69eeace5025fc1f98582fd1accb7da9bfadced3e21e0cfd47e6829eed91c74615919a26f006
- SSDEEP 1536:69zy20+ier26xeQ7YPuSmDBNtwcmVKm/7LRmV5EJuCAx72mL9JCuRtqdK7nV+gwb:KoEEJur72A9/RFEgwvD
- TLSH
  T1E68319DD72CAB06357A730B9506F510BF2765988784C8410F268D8E5FC78A4A827BF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  option.html
- Size 1016B
- SHA256 41f8af66cc86eb215d9841eda4f195494fda55ee92f795f8b543cf6986cea3df
- MD5 0cccbf4cb188291e0dfd42e88487ec3f
- SHA1 c98e09e95558660b6d5f536011176becbbe0c1de
- SHA512 a871afbd711289105862e9a086337b36ca1c138849b5eba1be0109e77c5bec35558a465420809277e31d3bfd13d3dc905ebe277d38fa3c31e3583de6f8422e61
- TLSH
  T1A4110C10F4F0B56A2623045E9ED299215F5D010FC9667880789DA5A8EFF8D8BFB171BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  option.js
- Size 436B
- SHA256 0c2b39c12ce08dc99f5aa4e673f4bbd88ae1566c30c29122b4b105246882d119
- MD5 5e7fd35fcae51520ea3783f691f99c03
- SHA1 0f75899984ef28b48baf869255474f60e2e8d823
- SHA512 5fe58111032a4663b908a02fe01d24e6586d50e681ae6bb35959a454238f92eb1d06f733b0b12de825c051a445b8365b89bb5f0b41be671f4ec6f8bbfd02d818
- TLSH
  T1DFE05C6966E122B01F3F09B75997614890780094AD21FCD10849DCCAEDBCD4CC347E5B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24