508a80f4149e210ebbbaac5e9bdf0864bdfa9340526c5cd80e0218b678132a7e

Sharing

Copy URL Twitter E-mail

General

Target
camfrog_6.1.146.exe
Size 7.2MB
Sample260905-sm3fpstyfw
SHA256 508a80f4149e210ebbbaac5e9bdf0864bdfa9340526c5cd80e0218b678132a7e
MD5 c8713ff0ea1da410600b43c5109274b8
SHA1 59d8db6d00974e6ab80a7899f22e042f1707668c
SHA512 2c2809fdbf3ce29aa5af3e70a7af4dd2da6f4e9b8cfbadeb52658c82a9d6cbae3b759c654f3a8c72d123c477b709eccbc8f0abac73da05fffbb393c57a9c6466
SSDEEP 196608:MaiM/dPN2tuYDM9/5VAu+WRmEPlciHY5NA45Su:Ma3dPwuEM9/HP+WRXmi4k4X
TLSH
T1357633ECAD82D9C4F92C49B15AA7D1324B277E3E55904D9BA8DC3F2434B358C6600DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  camfrog_6.1.146.exe
- Size 7.2MB
- SHA256 508a80f4149e210ebbbaac5e9bdf0864bdfa9340526c5cd80e0218b678132a7e
- MD5 c8713ff0ea1da410600b43c5109274b8
- SHA1 59d8db6d00974e6ab80a7899f22e042f1707668c
- SHA512 2c2809fdbf3ce29aa5af3e70a7af4dd2da6f4e9b8cfbadeb52658c82a9d6cbae3b759c654f3a8c72d123c477b709eccbc8f0abac73da05fffbb393c57a9c6466
- SSDEEP 196608:MaiM/dPN2tuYDM9/5VAu+WRmEPlciHY5NA45Su:Ma3dPwuEM9/HP+WRXmi4k4X
- TLSH
  T1357633ECAD82D9C4F92C49B15AA7D1324B277E3E55904D9BA8DC3F2434B358C6600DB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Camfrog_Chrome.exe
- Size 569KB
- SHA256 2c041dcfd25f347713fbeeab8374ac2b4f0dfe3b2ab3f217a585564b51d1b623
- MD5 5d88dc36b1336dbde692638368e26967
- SHA1 c8032f3b0f86960700695e663a3878dc2c5e81eb
- SHA512 4d1852299c9f059bc52955865bfcd1b534a0fbaa616334ec6c92acc817bf3c1bce9477b5fbc5ee79618fe362a8d64533e3acbfe6d203e41a50a56207a350d746
- SSDEEP 12288:tmt6cgOkXAQjfbE2YCyz+/UcYyOk3jFZcngtv9e+Y:st6nOIo2xy6MlTkuCle+Y
- TLSH
  T1FDC4238EE624DC23FABA4B38A4F8CF64D5D4CA02DA5B252EC3904ECD59661C1871D7DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral3 behavioral4
- Target
  $TEMP/googleupdatesetup.exe
- Size 549KB
- SHA256 d31b7c8cf3207b19e18e899523a3d7caabf8fd1ac5cca38a4bada87516333091
- MD5 01e1716a03b513f6538e022dd0ec6ea5
- SHA1 9bbbf3b31340f4b049fd97ccfd34b2a03ac4ec39
- SHA512 ccf065518cab5f34001f61f2e7f5350862c75b1b8cab7a8697712bbf4fb28789496229422a7cddaa68befb7d93afab3c37e799d4b267c300d56333f5a15cada6
- SSDEEP 12288:LxTKk7QjSbE2xSyz+FUFYkOu3jgQcngtK7++T:lbY20y6qeVuqCCNT
- TLSH
  T18AC4120A33F94469F6F76B38ECF58AE149E4FD429E35621D83D01B8C0D319D1D2687AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/Camfrog_Toolbar.exe
- Size 261KB
- SHA256 30d3d2f8cbbed9305a4292342d32acd2537c437c52b592877ebfefa1e4adea23
- MD5 ce0a85f1a15af7490f40bdb729f0316e
- SHA1 206b975e495a049122409c4b5ddf250083226a47
- SHA512 427a679444359febff4e03acd871091892e4428648f07ccd63d974908103ec789e492f79c57fcf7602fca725cf389b81316348bc4aac90f15580f54b84ff1fd9
- SSDEEP 6144:cmt6MmlXt2svZLLIb/TbVPXe8DyF8dT6OVk17gJT6uWEeK:cmt6tlXt2+ZLkbBPefskNgJT6BK
- TLSH
  T180441244F7A19467EDF50F309171A766EFB9C912ECD0B28693644E1E3BBABD1A40C324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware trojan
- Downloads MZ/PE file
- Executes dropped EXE
behavioral7 behavioral8
- Target
  $TEMP/GoogleToolbarInstaller_stub_signed.exe
- Size 229KB
- SHA256 ad68cfbbd2765be47b430cb0b3b527ade826e43c2ed6681ce6b9b5b44c8f18ff
- MD5 39d998e29dc9277c8762070901e69a32
- SHA1 ebd09f3ec33b4e56ebc3eccc0107689d4c5a2bca
- SHA512 cec7b2dad52ea5015c1a7b819fc1c3287325711b43dee50827f90b9f890dd4d34acacfa1fb65e3f0e62835dfaf0b1c93cde84274c78caf76e1cded8e327d7834
- SSDEEP 6144:M3wpq8sDsLLIb/TKVPXe8D0F8dT63VkiHFBGeWIY4AfJrrUZ:M3ssDsLkbiPenXkMNWIYzxrgZ
- TLSH
  T13F341264F6604715E9082FB85176E6DEDF319C4AAE9260D14132FD3E3EBA3747A08738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery defense_evasion spyware trojan
- Downloads MZ/PE file
behavioral10 behavioral9
- Target
  $PLUGINSDIR/DownloadOffers.exe
- Size 2KB
- SHA256 b5e2da84f65b658a50787b092f5a30611e11678afe8e7a066fa8cb8d698e6bcd
- MD5 2d416652deca0becc7bbb2f564c0c182
- SHA1 9e3635591c745ee311c4ada7758eec464368def4
- SHA512 d94b33da1b8b5fc822a70b65b66f1492cd66770ff4de6bdca584f3f463a626c8768113e3637578a5dbfb98adc88bdeec3f4bc1f1c532fd746ab8050a84caa9b2
- TLSH
  T18C41DD270BB0DC73E0180B7082DE604D70B988444BEA9A222AA42C2732673FF45F0F62
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/ExecDos.dll
- Size 5KB
- SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
- MD5 0deb397ca1e716bb7b15e1754e52b2ac
- SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
- SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
- SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
- TLSH
  T153C1E73AF2E409B3C2A806343EA6A42B17F9D02B071409B7876321CC6CD0DB8FE74256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH
  T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/cfigm60.exe
- Size 35KB
- SHA256 7950d035278918a60326c30cdb2aee425538522d5efcc265b6ab74124cac7b82
- MD5 4732c6db3870396785f148637036d2d5
- SHA1 a781adabae75d81fbd1d6f1b0ab270ae29fb28e4
- SHA512 043d0e621eddfff09b77ed9356b1e45eb85c3880e65b66ef72cad14bdbf0ec5ec6744b314ab0b4c213683463cbfad54df016534ea9c3a9f7a4bfb72e75ec10b2
- SSDEEP 384:5SdZ3S75DW0jRT5XmCCfUILFdAb6S4uT57V9+TmzApfhANLM8uYvnu3+/EDHcRqc:Hxb52PM4ofETmzoh0/pn2iED5dmwIN
- TLSH
  T187F21912B6E28433E1A3593158B4E2B15A7F7C52277440DF379812BE5FB1AC18EB835A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/eula.html
- Size 42KB
- SHA256 259bb6a2cdbac92d51747ed4d7b5b50c9810d7a9ff4832d39b76532000d42c1b
- MD5 9efe25368776214ce94c57ed34de97b4
- SHA1 8353fa74b0422ba5ab20e761c0b96d194e53651b
- SHA512 76417decb2c08d8319066086472dd77bf81f9d6e9d7133400fecdcd0a70c0dc0856d0fb24e4dd780ebb6004d4a4f2a4f7a9fb75bfde99e88234c934edd81b43e
- SSDEEP 768:SkE8Whx/iSPTJV5Fs3QmcVeszeMAv1rMUyZMX6v4:Ski/iSPTdFsjcVeszevv1+4
- TLSH
  T1BA1383AE7B4503E30AD103613F0366DAF71BC23A322A5695356D819E27F1D6C42FB5E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/gcapi_dll.dll
- Size 64KB
- SHA256 996fdcdbc3118570b5f250fb06a101306fbacd15a5f82ae3fbeda8049ea73d03
- MD5 1f90c49bc9eae611aee441e97b6a2b2e
- SHA1 13289dbf63d2ff3d7674b4eaa7fe8f8d2b54e2da
- SHA512 6945652d59554a899c0c7c15fec262f54e46eccacebf127e8c2d8fd3ac04a93add5e44d7bde4c260b4d9f913172af9238e4a443862dce088fc0ceb9a39ef3df9
- SSDEEP 1536:ym4zAUy/W3uc1bp6YI5IE4T385DnbU+VgR:yHJ3uezIH4TwDnbU+V
- TLSH
  T183538D21B9A1C8B3D45A41799656CB017B7B78526BFAD8833F9B078D5E212C0B73F342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/gtapi_signed.dll
- Size 71KB
- SHA256 89e157a4f61d7d18180cb7f901c0095da3b7a5cc5a9fd58d710099e5f0ee505a
- MD5 61bc40d1fad9e0faa9a07219b90ba0e4
- SHA1 5b5c3badedba915707000d2047eaf13f27b8925e
- SHA512 fa341aa975c471082b4b6c380f794d1e9ab3939382972cfb9e1dbb3491f68296ad1cedc8f03736921c8e133f62432997de29642e223c2a97f1cab5ce91d68af9
- SSDEEP 1536:/J6IYeD05jIx9A1jV0PAy/DTPJocNmk8SwD3QVS9JBhp9:/JL3m0l/JocNmowD3QVS9Jx9
- TLSH
  T174636C6230D5C0B2F55D067E908AC3225B6679908DF649C77FD307CA8E266E6EF2E341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/killfrog.dll
- Size 18KB
- SHA256 58d56845f9bf28bc8e67d0c136810468e3ccf7250deb307d2136d8a28594173d
- MD5 0d78d4939f894cec98bde4ce1aa77e7a
- SHA1 68b2219046becc3b91040e1f24d83f926b0d6499
- SHA512 cb8e1a6dfeb94a5a44f0d6365c39fd50c5047e25abc2a20f65969ca300ce8db1ad4eb13cdcb6961ee74198bbdd30a5802b37b91ffcd7a2b37488754ab53277ad
- SSDEEP 384:CRhJoPR0bQZQXtMDDXkNFUMYJLn+bCHx1q:chJo+cQQOFUBL+bCzq
- TLSH
  T1DA925CF36F2400A3D9495B70E0F9E6174E7577402AE4509759F0898A3D8A7F63B1F21B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
- MD5 f7b92b78f1a00a872c8a38f40afa7d65
- SHA1 872522498f69ad49270190c74cf3af28862057f2
- SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
- SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
- TLSH
  T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/privacy.html
- Size 9KB
- SHA256 295ff9abe0689ea65474993a1145f60a94d971e3fae0ba069a693a5dbc6e963e
- MD5 ad68e253412fb718415690ee0c4363bf
- SHA1 401af717f4a217dae57bdc596d2ba286f4595013
- SHA512 eca968d54c196aec23e458d9f406c7cd08762b2fa9cb5f3b7b0a8943d3cf337eb0bb4630137f1598bdcf4c882f0ca3889ee4f17ae73d34248a16577e5b9531c4
- SSDEEP 192:SlNFhvNv7BVb0VdYvqujIzIWphQ7zWcjPELqOsq:SlNFhvLheMf3TjPxOsq
- TLSH
  T1011283ABE6813292147303722A53E761FF1640AF3315A5253C6C819B9FF2E16872B3F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/w7tbp.dll
- Size 2KB
- SHA256 65e3d41af62784429ebfbd8b17426a89e4c7643a94d9811aab62809711bdbc6d
- MD5 71ca8666466a334aba2f8cd2b7868feb
- SHA1 18a0bfb286c56ea10223bf8315480e8a5e396e08
- SHA512 93cb29a8cf1302e45894cbded4cb3469e574a2e3d2cff5da934c770cb31e4e9e3b5b0aa53230f752e80cd721d500191b3bfcb800d6e49efb99b34b2285f1b2aa
- TLSH
  T1DB51027363B2177BC19522303B93A725B2BB497093D6C09A4CFD495E715468DD43CF86
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Downloads MZ/PE file

Executes dropped EXE

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32