b8aa003a8d2dd477bdc8cb0795fc36afde6a08814c28f6d632b3f1f4c172c852

Sharing

Copy URL Twitter E-mail

General

Target
b8aa003a8d2dd477bdc8cb0795fc36afde6a08814c28f6d632b3f1f4c172c852
Size 8.9MB
Sample260908-r866casfmf
SHA256 b8aa003a8d2dd477bdc8cb0795fc36afde6a08814c28f6d632b3f1f4c172c852
MD5 3617090806ce5d60685454cade758dd2
SHA1 ac6c5ae611417869ce38ab62f8268283ceaf04ad
SHA512 d9cb2fb301dcd478b298a3ec40c3ec14ac5f1633a4f74cb08114a356be703de7964533448a4fdabe3ce7be77bfd9cd35a7520dc9e4cbe62f99dfa5804a9cf484
SSDEEP 196608:H4JZ6+cMifcOYyMENHNi+jKdcapSEehB4nR2Y1rR3ESlts5r4cTK:HK1ifcbC1KdcapSx4R2K3BluRE
TLSH
T1EA96334073D1A518DC6B10B3B382F61D23DBF67E0AC962BD8755C27DA9729D0B70E229
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  b8aa003a8d2dd477bdc8cb0795fc36afde6a08814c28f6d632b3f1f4c172c852
- Size 8.9MB
- SHA256 b8aa003a8d2dd477bdc8cb0795fc36afde6a08814c28f6d632b3f1f4c172c852
- MD5 3617090806ce5d60685454cade758dd2
- SHA1 ac6c5ae611417869ce38ab62f8268283ceaf04ad
- SHA512 d9cb2fb301dcd478b298a3ec40c3ec14ac5f1633a4f74cb08114a356be703de7964533448a4fdabe3ce7be77bfd9cd35a7520dc9e4cbe62f99dfa5804a9cf484
- SSDEEP 196608:H4JZ6+cMifcOYyMENHNi+jKdcapSEehB4nR2Y1rR3ESlts5r4cTK:HK1ifcbC1KdcapSx4R2K3BluRE
- TLSH
  T1EA96334073D1A518DC6B10B3B382F61D23DBF67E0AC962BD8755C27DA9729D0B70E229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  extensions/chrome/background.js
- Size 47KB
- SHA256 fbda163cccfe08b5b5aadb8c8a48dac9edf70a504ea9496361f35790a8ea592f
- MD5 a31dfc68d3ebe136825fd4746096a8c6
- SHA1 6d6d581f855bb850cf95de6ef8396e3f225f9f30
- SHA512 da791fb37ff284e1779f5cab4e81b52883c3f28983f6c8ac34dadabf6763816f59de5d40dfc2db58c2cc78c152a4a5d8644fc1808a7687e5208cb2bce62949ae
- SSDEEP 768:B32AwNJZTZ8N+2SsBjR88/H+65/bqm/s0qUqXJ:slZd8dSsBjeYHz5zqmlqn
- TLSH
  T1DF230B8A5D3536774AB2E2B58B0F5056FF26C2272742C39079BDC2582F3542442BEFE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  extensions/chrome/content.js
- Size 35KB
- SHA256 a674e2ee297f35b5eced90dcbc7381049115ca56ea1df613ecc6be4fa5ac15b7
- MD5 eee30b737687e1fc6f797dac4a31ec5c
- SHA1 d4d8a047751e1c0f29d2526dd053a862aa71f099
- SHA512 3906d7a00984b587764e3e4112d074e6c50d073e20dd1b8a3fdb7461b8288978922c8f51bc65fcdb14b801b47ff59b5ff8fb7ba8b5bda695cca7d643fb87b3a0
- SSDEEP 768:JP4DIsEt3eqnde8pTVCKfhaKh9oosc/aRTdg4lisnN1NUUAg4Qzo:DsEJdMK4RRg4li6N1NUUAg4QE
- TLSH
  T13EF2192B625452BA89718375A78E6285FB3140336253C3547CBDD2483FB2C21A1BEFDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  extensions/chrome/popup.html
- Size 1KB
- SHA256 528ea39c3f1e613756c3e554e017a36db3030651fc6c8f36c6eab10f03e16a69
- MD5 53c0e6aa53cb9e15560685816ee9fd58
- SHA1 0cecebbdaebf7bad953d64d17a81d3aeef192dfa
- SHA512 fbb414fb7b1d154b1fe75d9f4f925f21347decbdf9bf3a8b9a4c4bc2dc09cdb1b23d6e6fd355e2a8f951bb28a6a2c821589c5a865af5736862db3f25479534df
- TLSH
  T1D711892150D16D13023390A3BE874B09FED08417D3A12814797D0327AFF2D14961BA2F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  extensions/chrome/popup.js
- Size 9KB
- SHA256 9b2443dfbd4708de114fa45667f87814e987328412d31d3c922be6deb2d9e3da
- MD5 06f3a34656c7a03c867e0fbe64637627
- SHA1 6cfc2028708e138c200c1bdab3e9312d487b0d88
- SHA512 3f70ef05e028fe0b7f055bd5c2f5157d3da95b34e3f02cb393ad7685e0ff9ec6774bacc09caa9cf2bf2f734a6cd119a7cd1513f8ac79e2cd11b5c2da3ac83135
- SSDEEP 192:FrO2YEoAqo5iN7H4cFz4vauSJC5fF+4hKz+WEG0U:FKA55iN7H4cFz4va/4hKz+WEY
- TLSH
  T1371260386065293A8A7693736B5FB548FBA9C1232321C2507DDCC48C3FB1865D1B6FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  extensions/chrome/welcome.html
- Size 18KB
- SHA256 2b8ada8ed7e0b5469029df4b4e2c5e34faa0516ba87590bdacababa616837cc6
- MD5 39bb410a31aaab244fd01e6467ad2ba5
- SHA1 0d68fc842cbac739abd031869a58580d2de1ccf4
- SHA512 bfd9ad6c8916e5c420684e2e5bbd46041dd7ccb0be9093915fe4bae8b4e99b7bb8b93283f8e5c74c45d8a1da4f2ce0922e161880f192b2183b03063e213107aa
- SSDEEP 192:JsaB79X9fj0rl9pNFucIDu+9s3aZKQZDbi+SnWcjI3J4VrP2fsCWhO:ZlFcUtvTOWUs
- TLSH
  T16B82932ADF8051662533E3A5AFA7639DFB52505783028268BFDD53110FB1A68816FFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  extensions/chrome/welcome.js
- Size 2KB
- SHA256 2fde15a1515e2aa57609b579066cd7e92f907889326563156cc05c5b8752070a
- MD5 e1a7a46ac5ec51074565c42dcb6c4ecd
- SHA1 27d99f6aaf2814dec5c3cb6579fc3606d519205c
- SHA512 41137833de1d29ecc41b0234831dbbac59a30ff389fca969463f87c29f5dd63dd6e6e4f642e5062bd561a2564869896f792b6cfa7ef1a62f07de3ed1d9a2861b
- TLSH
  T1EA51677A654456770DB343A36E9F93A0FF628125C7178F6238DEC1181B6082942BFEED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  extensions/firefox/background.js
- Size 47KB
- SHA256 fbda163cccfe08b5b5aadb8c8a48dac9edf70a504ea9496361f35790a8ea592f
- MD5 a31dfc68d3ebe136825fd4746096a8c6
- SHA1 6d6d581f855bb850cf95de6ef8396e3f225f9f30
- SHA512 da791fb37ff284e1779f5cab4e81b52883c3f28983f6c8ac34dadabf6763816f59de5d40dfc2db58c2cc78c152a4a5d8644fc1808a7687e5208cb2bce62949ae
- SSDEEP 768:B32AwNJZTZ8N+2SsBjR88/H+65/bqm/s0qUqXJ:slZd8dSsBjeYHz5zqmlqn
- TLSH
  T1DF230B8A5D3536774AB2E2B58B0F5056FF26C2272742C39079BDC2582F3542442BEFE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  extensions/firefox/content.js
- Size 35KB
- SHA256 a674e2ee297f35b5eced90dcbc7381049115ca56ea1df613ecc6be4fa5ac15b7
- MD5 eee30b737687e1fc6f797dac4a31ec5c
- SHA1 d4d8a047751e1c0f29d2526dd053a862aa71f099
- SHA512 3906d7a00984b587764e3e4112d074e6c50d073e20dd1b8a3fdb7461b8288978922c8f51bc65fcdb14b801b47ff59b5ff8fb7ba8b5bda695cca7d643fb87b3a0
- SSDEEP 768:JP4DIsEt3eqnde8pTVCKfhaKh9oosc/aRTdg4lisnN1NUUAg4Qzo:DsEJdMK4RRg4li6N1NUUAg4QE
- TLSH
  T13EF2192B625452BA89718375A78E6285FB3140336253C3547CBDD2483FB2C21A1BEFDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  extensions/firefox/popup.html
- Size 1KB
- SHA256 528ea39c3f1e613756c3e554e017a36db3030651fc6c8f36c6eab10f03e16a69
- MD5 53c0e6aa53cb9e15560685816ee9fd58
- SHA1 0cecebbdaebf7bad953d64d17a81d3aeef192dfa
- SHA512 fbb414fb7b1d154b1fe75d9f4f925f21347decbdf9bf3a8b9a4c4bc2dc09cdb1b23d6e6fd355e2a8f951bb28a6a2c821589c5a865af5736862db3f25479534df
- TLSH
  T1D711892150D16D13023390A3BE874B09FED08417D3A12814797D0327AFF2D14961BA2F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  extensions/firefox/popup.js
- Size 9KB
- SHA256 9b2443dfbd4708de114fa45667f87814e987328412d31d3c922be6deb2d9e3da
- MD5 06f3a34656c7a03c867e0fbe64637627
- SHA1 6cfc2028708e138c200c1bdab3e9312d487b0d88
- SHA512 3f70ef05e028fe0b7f055bd5c2f5157d3da95b34e3f02cb393ad7685e0ff9ec6774bacc09caa9cf2bf2f734a6cd119a7cd1513f8ac79e2cd11b5c2da3ac83135
- SSDEEP 192:FrO2YEoAqo5iN7H4cFz4vauSJC5fF+4hKz+WEG0U:FKA55iN7H4cFz4va/4hKz+WEY
- TLSH
  T1371260386065293A8A7693736B5FB548FBA9C1232321C2507DDCC48C3FB1865D1B6FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  extensions/firefox/welcome.html
- Size 18KB
- SHA256 2b8ada8ed7e0b5469029df4b4e2c5e34faa0516ba87590bdacababa616837cc6
- MD5 39bb410a31aaab244fd01e6467ad2ba5
- SHA1 0d68fc842cbac739abd031869a58580d2de1ccf4
- SHA512 bfd9ad6c8916e5c420684e2e5bbd46041dd7ccb0be9093915fe4bae8b4e99b7bb8b93283f8e5c74c45d8a1da4f2ce0922e161880f192b2183b03063e213107aa
- SSDEEP 192:JsaB79X9fj0rl9pNFucIDu+9s3aZKQZDbi+SnWcjI3J4VrP2fsCWhO:ZlFcUtvTOWUs
- TLSH
  T16B82932ADF8051662533E3A5AFA7639DFB52505783028268BFDD53110FB1A68816FFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  extensions/firefox/welcome.js
- Size 2KB
- SHA256 2fde15a1515e2aa57609b579066cd7e92f907889326563156cc05c5b8752070a
- MD5 e1a7a46ac5ec51074565c42dcb6c4ecd
- SHA1 27d99f6aaf2814dec5c3cb6579fc3606d519205c
- SHA512 41137833de1d29ecc41b0234831dbbac59a30ff389fca969463f87c29f5dd63dd6e6e4f642e5062bd561a2564869896f792b6cfa7ef1a62f07de3ed1d9a2861b
- TLSH
  T1EA51677A654456770DB343A36E9F93A0FF628125C7178F6238DEC1181B6082942BFEED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32