eb6a02b5135ac4ef3c6eac3fafd5ce520c94a36b6d541dadf0e91a88ce4d8462

Sharing

Copy URL Twitter E-mail

General

Target
Maiss_support.exe
Size 2.9MB
Sample260907-pp1hcawhrd
SHA256 eb6a02b5135ac4ef3c6eac3fafd5ce520c94a36b6d541dadf0e91a88ce4d8462
MD5 18fb1bd558b8ad93244ee98d3e8c569e
SHA1 5adbeb03a13e37ffbaa3837c67a9afc6d3abd6e3
SHA512 a6f17a7bf48b0cbe33d9e5916e8409ae4072b3dcdac7433f4074c0aa4b9f9b321c3c7be76194ba6423a6cc6308fde7f1df6294534dd60324aaeb7c5efc623dc6
SSDEEP 49152:OS6BVgiZEG0Vi14U9goEZG7KnIy1aXsa1Ew41JH/3RLAXbnqkbkxGCCn0UUo6/gd:OSkbW9UmoEcK51crET19/hEnsxzUV64d
TLSH
T177E533D6C94CA69BD008677170FCE07C6AD0AB1DE7B272BC176943CDB4F7A191096272
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Maiss_support.exe
- Size 2.9MB
- SHA256 eb6a02b5135ac4ef3c6eac3fafd5ce520c94a36b6d541dadf0e91a88ce4d8462
- MD5 18fb1bd558b8ad93244ee98d3e8c569e
- SHA1 5adbeb03a13e37ffbaa3837c67a9afc6d3abd6e3
- SHA512 a6f17a7bf48b0cbe33d9e5916e8409ae4072b3dcdac7433f4074c0aa4b9f9b321c3c7be76194ba6423a6cc6308fde7f1df6294534dd60324aaeb7c5efc623dc6
- SSDEEP 49152:OS6BVgiZEG0Vi14U9goEZG7KnIy1aXsa1Ew41JH/3RLAXbnqkbkxGCCn0UUo6/gd:OSkbW9UmoEcK51crET19/hEnsxzUV64d
- TLSH
  T177E533D6C94CA69BD008677170FCE07C6AD0AB1DE7B272BC176943CDB4F7A191096272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
- TLSH
  T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/ReadCustomerData.dll
- Size 64KB
- SHA256 5f76752e83789bb8184070d618d83f43c2f565cc7fad2c4266e44339223ba69b
- MD5 703598aa5ff97f512112cd766543a2f1
- SHA1 0bfb74b03227ee8510e153785edd76625404ab55
- SHA512 3eff4670a3c97ec931eb1240d22a943ad6b19ea07ce781dabcc656ae2049d36c42b8f5bf3ce59366057ea3ece8913e83da3ec98c2c1434edf144dd9d4731fe58
- SSDEEP 768:TWaFM5hBUVVsDPytWyIBvsdfk3Nhs8o6S5uymhRv1OInQ/bTLZmTtxHWQ:CvnuV+TcWGIPOChRwIQ/XLQtxH
- TLSH
  T163538D107560D8B3C45E453A1056DB12BBBF7A526EF9D4437F9A0F8E6E211D0AB3B342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- MD5 00a0194c20ee912257df53bfe258ee4a
- SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/TvGetVersion.dll
- Size 55KB
- SHA256 c774a0fb87248b985b8543bd5ce2d5f58d64c091c912de8c0d45d9ff18ca1835
- MD5 bec86f19027cbb13f05881e6712388f2
- SHA1 c5fe5ecffe244869c60d8e3a023b610a08b62ff4
- SHA512 553a707b7b3d2b74039695e01c0a74c9c9a84696c67a1c087680fac8384998009369cbe78c6f1b23a018d0f4b46665379eb6f22bc0436d15d385bb8625e14837
- SSDEEP 768:ZX4xrWyk9mIyPmr5yPItXjZJ/pY0RaOnot0kEabnOhXw1tslXYBt:ZXw2mIydKFRaM40khOhMtslXM
- TLSH
  T136435C10B5A0C4F3D0558279349997125EBFB9217AE98443BFDA0A8A6FB13E0673F347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 176KB
- SHA256 0dedad042a306da32784c3ce79bfac0475b827e416c17e1a1dfdb461151f4271
- MD5 06ff2b95b8e123d32487b0cb73409031
- SHA1 8cb3f584112db4e74cea4ed02d4ce0b3a5373bfa
- SHA512 174e7599ba87bc45111ce340d7563771353df71988d6b9094d8bdeab4b45ec730cbd2e6bf3943ad66daa02d7f1f1eac0020b987109fabed96b2e0def8d0602c6
- SSDEEP 3072:rfSCQ4FYoKhEHvf4aytolZ8MMNjXtWXTkibb7zHetRYFJ8:HFYosEH3UtoX8fUtXPOm
- TLSH
  T1EA048D2236E0C07AE31F0332CD17AB6172AAF6508F61D54B3F894F4D5F726999E29706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  TeamViewer.exe
- Size 6.2MB
- SHA256 015b1912e194a987b997453d34807c61964695668e96798f1a0f14d8b860b441
- MD5 93f07bec68e8034a720af5d8192cc7d9
- SHA1 2712801b4eb30809ce7737a3058e39d23f57cbef
- SHA512 df762eae64b4eac28c432e767219fbebdd2cbeafdf42a454458c5a5142de9f65152b4bc917af421e62065656124f64e734863ce22165c617536a3cf2e2067292
- SSDEEP 98304:5rPxZWF5vO3sdWADovMsyvXEwUKTvtF1eyKTxcraQsCQkBHIhAND/uF5wjQOo+sX:5rPTcvO0DDAfy/TvtZZIAuFa6aIrpB
- TLSH
  T18F669E323AE5C47ED2B303B1592DA29915F6F9709EB0465B72A4572E7F74E839030F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  TeamViewer_Desktop.exe
- Size 2.2MB
- SHA256 701fa727912566b842d6072839d4f4af505f2d9662bea789bd70460d383dfd00
- MD5 de387d6df42108e47e5b771edc1a9307
- SHA1 b8f3150e6e2431a52373bf50514cfab370cb14df
- SHA512 91d014c1a70b23f91a9ae6159cdecca139231ce7db408f7f0edf22259cb820323060d3165639093180ec3b18b783cf4e4e9cd06f8f126cd765c86169031d8d73
- SSDEEP 24576:P/OJmyMRRS07UdaYN1jgH65zwDX+8VYrI336RZrhGT0zAFGSFAzgCu/kKiJycmcX:9HszfnzcX0rI33IrhGhFauathNZBr1
- TLSH
  T1C4B59D327BD6C47FE1B30771582D925952F6F9B05E30858BB2E4572E2BB4A83C521F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery spyware trojan
behavioral15 behavioral16
- Target
  TeamViewer_Resource_de.dll
- Size 255KB
- SHA256 e176c591d5aedf3a4c96a53c826343641abfd15c2ae79c43ed5e8bd945208783
- MD5 b30e46df951aaa423d3d4b651628e19f
- SHA1 26af6c157651051580cd05ed2e0eced117f5c74d
- SHA512 9f0571c6be0603ab59f2b771d036fdbdd1f5f7b247bfcb77d29585bd9fd4a7c34bed6e90d11d758bc18d6b1461f39d0cbccf3e940bc9bdbd97bb6ed5aaa81c2a
- SSDEEP 3072:+nDdofYRxYv0sSpMU4HBpIcNZC8MBoeWkWXgtUA4mFhTaRY887hHY4inZVl0v8HR:dSh4HLxZGtEp
- TLSH
  T1E644201153E98A18F2F33F746EB953A46E72BCE6FD79E64E1710618C1871A409E60B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  TeamViewer_Service.exe
- Size 2.6MB
- SHA256 1dea67a601eaafaba2cb80229b1a4a05b6099c6f1be2ed5b20487786c82b8417
- MD5 bea57f6d10e8ee1a59d05c378d6649d0
- SHA1 d919eb6dc0a4c9e288a54bf3a5100f85518599d5
- SHA512 3f6fe928906fc14d694309b8068457fd6feaf932abf8ff9431056ee64c9b5fd5ffab1f9cfc546ee4a9f740c7a3516d4e2469454f032757e4577e4b920ac3b1cd
- SSDEEP 49152:EW02brLiE0e+hSBn3x709EV+S0E06zDoHc4aMIbIoANGq/kII4dbGApETLe:EWR/pcehIKF0EhzkHcf8oANZ
- TLSH
  T164C58C323BD6C43AD6B31AB1992DA25996F6F9705D30C54F62D8472E2B74AC3C124F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  TeamViewer_StaticRes.dll
- Size 2.3MB
- SHA256 192e8b09becfbebac4fe71fe6ed391d0448f3c7056c88f68248be9a8505ddd57
- MD5 544bd524f936e803f493ab8ed918c25c
- SHA1 a84a04020b5708b14321a9adde34482e2fefbbc3
- SHA512 7f66fd5a4b3e7eb25202e737e5ac841d44f5121571e6fa6f14a90f258435fc07f05ef2fa9e999864ef2f98fdeaf4b7db230fd80e01d2d43b211bcec49be99d05
- SSDEEP 12288:07FRMxerSauRDWxe2CPE8L+YoBSNPramjvT1Vg:MprSajWL1T1S
- TLSH
  T134B5F38E0060CB45DE8F96F0C66C7DFC4446FDEB82AA00AF3943FA5934FB2518567699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  tv_w32.dll
- Size 64KB
- SHA256 ea3f4562e20e6b4bd892e11e597ccc02325aca1be579df244ce015b3bc7133c7
- MD5 cf249d56bb0d4685dd6c4828b97b8307
- SHA1 aed4ccf8f9a280b84796e36d56f3fdf373410526
- SHA512 f1ac55090ee93ad141e2cec3d9a0a98eddcdf50b26cddc41274cbb74fd87720584bf4aa37ae84683ea7c59d75ef0c26196a9aea1afd81b5836624ffc85ba4cf3
- SSDEEP 768:lkW6VIpfAl7yjqJ9V/iP30cu9FJ+VlTHPWyqPGYDIIL:ltqIpYYmOHuPAVVW9Z
- TLSH
  T1F3534B124203D839E4EA373589BE5E912C34E9960F7853C792B97392E8786D62D3D373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  tv_w32.exe
- Size 103KB
- SHA256 5531101a8387222cac733726f6f58fb02ee4ce7798e5964514837c10ef4f7877
- MD5 684c5d48dd6a0cced97c4fe983bcfe47
- SHA1 cf9c9c3d4d3bd073b83e169df85c074463b68167
- SHA512 7e3e88366df92a44ce981bb6d49e64cb642ddffcfe73322239e6050a53631f649706479bb37e260a299319d58d4834ffcb5b6edfa7573d647fea919fe9903c79
- SSDEEP 1536:QQLuOPVckAlDOuWen7dqxCuRcCfKZjwkDi/A5JAYR5vadW:TLvakAxdcjkk/A9R5va
- TLSH
  T1EBA37D227690C072D59615339D6AD7B69A3CF5304B749ED3F7884BB95F303C0AA3A24B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  tv_x64.dll
- Size 76KB
- SHA256 93bfe08aeedc6a995883e83652ec81080503104a69f15549f640e934aa691a82
- MD5 70014c076003d1d4822366c79ba3e3e6
- SHA1 af350e238354c8cb46b63aec7bdab680554e9641
- SHA512 7807705657cfced2423ea106a2492e4d494eb59f6b666fd448b54df196fdbf6618f470facbff71593b14b43b32d668f3868a21f6a880d2f84dd7ef491c330e64
- SSDEEP 768:mDpSeSiE2jFPM0BdmVI6pzYbW1fxkClSN8Qx9pig8HK77TkyYYYVoQsLtIIL:ASeSiEZs8a6BY1oSNbfQu7TkyYNVId
- TLSH
  T14D735B59969604A5E873823AD8B54A12C7B0B481037063CF4471E3659F777E3BE3AB4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  tv_x64.exe
- Size 126KB
- SHA256 05e3ae965608f662378232e4847754e18c09f2b98e5bbb380f784f320a865bd9
- MD5 84c57f59da45494c5a1c124bd294aa1f
- SHA1 d41c850246e286309ecc737e8d24ed1b16841640
- SHA512 715f981edda272725933cd0f6aab86049cbfc75f9f1b8af62a7be69512b559ae0592346b9b0b3ba763d7546ce60fa85362e657fab34d8a11caa26bc6be629627
- SSDEEP 3072:+UwSVG88g4k/sVlgGQZkc+DnFKPcQmlZKEdV/5QY:+I0VlgZZ5+MPcQ4ZlVW
- TLSH
  T11EC36C4BB7A540F8C84AC17ACAA68712D771B41A4B7443CF172887565F23BD1EE3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Checks computer location settings

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30