a1e3b059be682b13311bfe4289e69d5774fd11ba483347f640df0600740d44e5

Sharing

Copy URL Twitter E-mail

General

Target
dfsetup119.exe
Size 4.0MB
Sample260913-amvrraycme
SHA256 a1e3b059be682b13311bfe4289e69d5774fd11ba483347f640df0600740d44e5
MD5 3750b779146a5c8f79f71dc81415838a
SHA1 7464a8604b1371fb844e3fbbaaa1ad063616fb31
SHA512 e3271ae510289d85da53591c8efc4b19a7015f660b0637aac851757ef6139e01aaee7c901119aa0e3a4087ba51f0c2dc956ad255b6cd34ef4c1aabb3a0175460
SSDEEP 98304:shnd/jNez9FZd9ueSP8Pas+1LVt1FaZKMOFDBdc8G:Gd/W9FNueSYah1Zt1cZ6DxG
TLSH
T11D163347A24BD028E49446342DC2CAB7A8B7FC534B49A16FB7DE3BC3DDB8086ED51019
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  dfsetup119.exe
- Size 4.0MB
- SHA256 a1e3b059be682b13311bfe4289e69d5774fd11ba483347f640df0600740d44e5
- MD5 3750b779146a5c8f79f71dc81415838a
- SHA1 7464a8604b1371fb844e3fbbaaa1ad063616fb31
- SHA512 e3271ae510289d85da53591c8efc4b19a7015f660b0637aac851757ef6139e01aaee7c901119aa0e3a4087ba51f0c2dc956ad255b6cd34ef4c1aabb3a0175460
- SSDEEP 98304:shnd/jNez9FZd9ueSP8Pas+1LVt1FaZKMOFDBdc8G:Gd/W9FNueSYah1Zt1cZ6DxG
- TLSH
  T11D163347A24BD028E49446342DC2CAB7A8B7FC534B49A16FB7DE3BC3DDB8086ED51019
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH
  T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- MD5 9384f4007c492d4fa040924f31c00166
- SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
- TLSH
  T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/inetc.dll
- Size 20KB
- SHA256 e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b
- MD5 8d8fdad7e153d6b82913f6fdc407d12c
- SHA1 aabbeed33cd5221e4cb22aab6e48310df94facfd
- SHA512 42bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2
- SSDEEP 384:0B/JF+HUI+LzlKSYWwgdHEINlWya4LL0Ac9khYLMkIX0+GBxgW+x:WFo72lvYWwgy8Fa4LX
- TLSH
  T1EC920A02AE592AF7E3651970787C371346AAAE70342154C769F32FCD2829257FA37743
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $TEMP/ytb.exe
- Size 2.2MB
- SHA256 7ab505da56855344404834de64efa3c3bf396cb051f09f849c5ec24c1dacb0a5
- MD5 f0745c1e12ff5179d8452d162fa5369a
- SHA1 84ffda6e09fa86dd78d886854f24c1fbef04b257
- SHA512 0e6e973993da04451565347e6c4fddf7e677aceb136da3a5c11230ceab082829671b5f711ea6e1447f30da368207b95cdaa974251d9cf56494c007ba1cad10a1
- SSDEEP 49152:sLDL9QwXSoBJQX19YDSWWAoL5QnqAHYcFPw3tdq:sLUoUKIbMqoYcC9dq
- TLSH
  T1B1A533D38587F5CFE6E142B21C35A473806CAF8F1641406F9763BCEDAA7A487E047299
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral11 behavioral12
- Target
  content/ytoolbar/dialog.js
- Size 3KB
- SHA256 4e5aef8de1e1d533ce010ce31c462f9f443b8450fda53ccc8340715af116eb55
- MD5 d70400ffb5f32c6f436b7e30c5ad1970
- SHA1 0724a32cc3a74e4e60687c83855e5a91f5517b55
- SHA512 76bbcae2b7f9e437cf7681ae3d0abd8a0740c0152080af706113bea2988d969470cab1aff42cf74e8f3b434a666342a3a10154d158d7ed71d6ae0fa5f1c8bb42
- TLSH
  T1C57140783B4C837F2AD013288679D699ECFCD431950DE8E1D1AC992B40A4D609AEF6E5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  content/ytoolbar/feedFunctions.js
- Size 38KB
- SHA256 f5a52444a68219d125b063ac021244f15bfa2f359bdb82bb37fc0eb444857e74
- MD5 f95d072934fc40ad4cee569f00ed66f1
- SHA1 3afa9919dab0322fc01693fcb4dc84a5ec60709e
- SHA512 c3b1b787a6bb9c3dca63f5846109ee90324f300165008ce0378f97ecf6e537a7539089f763af6f0dd754aa65354af59411a7b80d81ce905e227b5b451b01cd00
- SSDEEP 384:gQ04nYwfO71GiqdJ87Migl+wUktjvh7rbHMYL0+lyiT8xDhD06z5ZSZm+wAPNd5+:gQn2IL8B/oZHzLkiT8zpkZ9S7hUdM/n
- TLSH
  T17F03B669330D226F16E5232846BE34C8EE7CDA71500D84F6BC58E994E4E446DC3EBBB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  content/ytoolbar/fileio.js
- Size 5KB
- SHA256 b967f565195487e3ce6976fbeedf92cbbd9f212bc5bfefad7fc52112dd567915
- MD5 ce97790e485ebe476c74e0c9c5278ade
- SHA1 37972b139a787040adcafbded249af8b220e37a3
- SHA512 a242f0915da59a67007f4f91954b88972ff7c5226830f5200129ce4a022d9d1356bc5e239518f4d3631c1513681f1406593dd2c88e8cecb434611e255afc8867
- SSDEEP 96:vkiCEh7Vu4MfMVIHr952YBglwBPqmkZ5C7YFtJ6Z9Ebt+:vkte7w4z2QYBCwIbs7utJ+ut+
- TLSH
  T1C7C156AD364D112F07E112A45BBC2847ECADD067492D41F4F1F9966CA4E0E09C3EC7E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  content/ytoolbar/globals.js
- Size 2KB
- SHA256 f63a635481cd77445d7052703cf556916569b3d846fbce3651dcf5482cbd55a2
- MD5 5101baa849b4b4726df8e49869405dca
- SHA1 d26d2462501a114585778c113130f3f2598ac0dd
- SHA512 81d3bad455c5149968b3edfc4f87eb32f8c1e2579b8019ad2f7cef92ad3c1f79da8714f0964929f54d480581a060825b33427c691b0ac0c14d13333a14946f15
- TLSH
  T1725102A673905CE7096252200BCF13EF69E5C402584DC26ABC7DF74473EA98FC0B45AA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  content/ytoolbar/history.js
- Size 5KB
- SHA256 54b6122ab0144c35370e42c84ac44590583b94ef20ccb73add66d53bc8c54075
- MD5 015adce6b2abac3f1e38501168c3dd31
- SHA1 fdb20102aa6ac36e3f954852228a091102c7943b
- SHA512 89cfb44a4d0f1c2432c300097ca4e92ec9ba09a4b811062519180521b7fc6fdb0098a922910b3940fa6352eef02f5e5215d960fb2420f91b125db000be68e5ca
- SSDEEP 96:gOSFoVHFE8VgiucTtItVx9Im9nRAk+7jXyrrt2d80H1V/ghtyA:gOSoVHFGcETImAk4Xyrrt0861V/utJ
- TLSH
  T1FBB13283335C502F59FA13280AF671C8FE7DD5B2A90A60F4B0F86CA8E6E4D1193E5675
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  content/ytoolbar/i18n.js
- Size 605B
- SHA256 6a34b9965e82b6b3808498336d5e208622fdc1af6628825579d51b7dc0377cd0
- MD5 0346d7c367761d96bde9354d97da3f0e
- SHA1 e2de654d6eb3989f9cc09f95e1fbe18b4ab76984
- SHA512 7e3e4ffb0673ff1e9275fa48eb20f7a956154d9a9b76bc5eb638b3ef4a3cd621a8ac2b5cf78e46b63c945677a149fd11b60f8de8ec3e8845cfd7c41dd0b0cb30
- TLSH
  T1A7F00CEB300A80375298258790F6698CFCF8EE30473FACF9F480A04A9424C3D22FD284
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  content/ytoolbar/installerVariables.js
- Size 357B
- SHA256 030eb8eb073f0a1e81e24e53925c760c5ebb3c41f24eeb2c0237ee85875c6bf1
- MD5 b9221e098729435e47a169c5809edec1
- SHA1 5c3feec55ba5dc583d826453f70f165f503664ca
- SHA512 65f18e629c64001621ae0434e8cccd588b48424837092087245453457e42dc0d81f24ac67b6777d6af13e57923f10b2b3ce9cff386235a101c7642ef868e9a4d
- TLSH
  T1C3E0480C4B31B1F2B3A2A3BF47939C248014B272605D647519F353450757919F0808FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  content/ytoolbar/network.js
- Size 2KB
- SHA256 94b709bfb3edd15281fbd34398357710dc6864bb08fc36223675223251531236
- MD5 e93c0d2fdb46f417203dbdac78167c2a
- SHA1 5bc82b03fd9e886f947fca32d3da9ffb560cd4fe
- SHA512 5f3dae338adae08c2db179bb2458efc17fc4df3b3bf3ddd4721abd296806e372ec5727d653b65b4d470719ce118b599a1a75605aa39810adc62f626fe00c8a01
- TLSH
  T13F5142EDB72C610B06D42046437E2614EDBDF8E1571D84E1B516E989E898A24F2FC7D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  content/ytoolbar/options.js
- Size 6KB
- SHA256 384b41fc1aaf4854ebc5252d2b171c87031c19504705d2a7d58b09511be9d2e9
- MD5 bdb6d9e09b0cf1981181017c361b88c2
- SHA1 c3ddae4f9236d2754b9660ffc1ace7915625e355
- SHA512 bfd45b2773cfc40643ce643906a249395794e8c75d36065df4ea8fdebe47e8b0a4d85d3256bf2838920bfdbdc927ab71ee18f43eb06cb30ec92223822230105c
- SSDEEP 96:gV54Ch9LQxwc4EUWkF71sGAZssa6CjsstLfGqpXJls/DHxrN8RGALIlA2pP0:gViChQwcm7q7ZZa/jZRZU/DnAZ2pc
- TLSH
  T179D1339B72D8113B47FB12B9047C6459ED78CD21951FE8D164B88D9884B8E24D3DBFB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  content/ytoolbar/setHomepage.js
- Size 7KB
- SHA256 566032ea3b7a7f94ef750df96027ef62a974d27fe25749f87240d2375e791086
- MD5 89f33cca146d786ae3c2722de8b01ae4
- SHA1 d5ee5ca7301bb63313930178a83727925755e939
- SHA512 ed26c0b8fe5aec832a5cdd2ee49f471ca4a8ed05a786900ef802f2fa51b62dd2bef003847df2b3233bfcbbe04ff6ef9f28452cd1ed06e9afe929084ecbf39a2f
- SSDEEP 192:gAabDHZSAFtpDocsZzFSOZ2UL1GdXKHWdXKQgctulAr:gdbDHZSaOTGdGWdDr
- TLSH
  T114F1B973324A01760EF52360657868D9FC9AC030D99EE461B27CD005A560EAEF3DB7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32