8884b8d1f7153b40266fdaafea8d826fbe3414c2f223c2fc99a07b9addef1440

Sharing

Copy URL Twitter E-mail

General

Target
IDM.zip
Size 6.0MB
Sample261110-ehrlratv7j
SHA256 8884b8d1f7153b40266fdaafea8d826fbe3414c2f223c2fc99a07b9addef1440
MD5 be7467faa31b3e3ab3e5b9ad619f8c80
SHA1 d8539dcd1b6cbdf94a789c5d7b08dd5b07cc0375
SHA512 171d78eecad53ea4e486c177cdc2ec41cad0c6dad5f479338f1000b898f9680e86487fc3db21b96a3bf0b5761fe5253cec7a409353287838f438770ad7726ba5
SSDEEP 98304:obwCchySQ2KAmoJOAhhaNGIY9AeLYrPCeK3kX424anVaj+2M00h9O3d7wlYjG+87:MwUH2yDGENGIY50rrK0osV8M00hwUF+q
TLSH
T1AF563348A9C5741AE06B7CB80F890045B6FC0E1D902693771D57DBE4A6825EF3BD3B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  IDM/!̻ж.bat
- Size 6KB
- SHA256 281512a1aac27e2597d6fc80ce5840f5240195f8c8c3164bd12663053c08a206
- MD5 69579bb381689e43a50927999554bf03
- SHA1 2b076a04bbe3fdd622f005ebbc4d86c700d6350f
- SHA512 f8b8b69264bd1833e91d6ab5902a30b0d20bf5adab5c522d9f6cce6f121229162c914ce7758d7ae5573ab4042a896776462decfc0cfe612bc87d13dd275dafb6
- SSDEEP 48:ZoMKbuvz+GDONjXUAPRAX12nwjF7Bn7BEv7BHXO7xYQKrx9Xj0zJgMbJf5UAPRA9:ZoMKbrUOm1CfXAczyk
- TLSH
  T133E1BD573A0781800E879917E5462D13EFAE864FC1E665C432A3F570AC9E6ED03337EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  IDM/IDMEdgeExt/background.js
- Size 30KB
- SHA256 1aee0d9bea29dbe429c25d1c856a8f6122562d7bf49ca112728bcee7da976888
- MD5 a08622da174674fd67dea8e8e38207b1
- SHA1 5636c5ea2255240f0c5872453404c510066a3328
- SHA512 5d746f0468169ed3e7569f44b60315756c6a95eb6d5c0f63d6fd7a76f57e67fcfddca82194901c184a753f76fba3e08c59b9108d2936b188ab466df0ade5165e
- SSDEEP 384:Kt0BNGCpwLg+mmu4bc1BqO7sZN0xf39L0VI/ImjVF+7tyg9jrItw97GEGxDuszfL:KuNz+mmu42AO7sQ5tlCQ0GEwDx6rQ
- TLSH
  T1E5E24CC73123345AA761A0F6981F46D6B73AB82D3448CCBDB425D4D22C7866E12BEF74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  IDM/IDMEdgeExt/captured.html
- Size 1KB
- SHA256 1e999f527d59a6bbe493f937cfb5230720b0da8543e276101ad3ab889dded1a7
- MD5 b9e70d1713fb37421512f2031a201136
- SHA1 3981f3339489d0412147cb809fdf75256b96d6d7
- SHA512 cb1d54a6a22a104fc0da5435c2bfd28443b4b633322a15be1a7127f55a8b3c1befd5d5316d337c5ab557d6ff5fb5e3b20b788083785b52e1b754a98886886c12
- TLSH
  T12311122F42B72C0ED6536AAEF495BB6818034140534B467531D32B6FA1F7092CE9628E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  IDM/IDMEdgeExt/content.js
- Size 7KB
- SHA256 8e52f5853eef47a2741494262e11bea6425ce9de8d6369b5cd0635bf45010854
- MD5 b8d2b88a9e3622c7afb968a51e55db11
- SHA1 901bce108b881bcb1feafb0c3dc60e9911928d52
- SHA512 b39b5c115216bfe2ba9491e95b0662a2abd3971b81f843feb377251751d031aca9c0abf3da588a334eafe8e6c87829d44daaf03563dfa04433ad8f11471891cb
- SSDEEP 192:12g1r2WaKS50OfjcgJkcxZSL9vdveJyOpDeTbCuAT:12Ur9aKS5jjcgucPSL9lWgOpDeTuu4
- TLSH
  T151F1A7AEB620187603E6D46ABA2BF245743714182847314CF60ED8D7BEB0FC76119F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  IDM/IDMEdgeExt/document.js
- Size 341B
- SHA256 37310ccfb001a6880f60f461da9b2671026f07959fbb8bdd7f44092c580cb455
- MD5 1c678f46940a7c4a579e5effadb846ab
- SHA1 2be15c40e6a99f168565675e3f131a60b25074ab
- SHA512 1ea1c425c31101b3a06cb655f50a26fee1a94c2fa18a64dd8b0700b140720e2ed6aaed6cdb3f3dbbc1ecb9bd19ef64310ebb6129bbcf3bff08c317c7ba5a5185
- TLSH
  T1B3E0C04EC3107C2404714B09F36F3B03352716455402C080531D4CD0F70AC5B8193DC9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  IDM/IDMEdgeExt/welcome.html
- Size 2KB
- SHA256 bdfd01cc30389fa64aad872b870a88553066f1b63deabb134d493877a4d2e57d
- MD5 cc64ffc9ff196c6b96483b603167978d
- SHA1 8e59ee8598b162ed27e7dfeacf54ebbf62187b26
- SHA512 26ba46e6aa96b2fd5e486e32ecbf7d522425825016493e65f9c3d9b1d5b5a5d8f6ae663f0975b5980a9af348a778d9bdb80a03737bd2b1853fd27720c7a58829
- TLSH
  T10D51D92E839F7C1F0033CA56E1B5E7788A22010493435331B1FB5A9B52DB562CBA52CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  IDM/IDMEdgeExt/welcome.js
- Size 943B
- SHA256 7b54ce4e74879280c02da884bb51b302ddb0c9bc02415631906960ec8a92fe26
- MD5 538d3643e901f087fed0b0a5e143a5f3
- SHA1 2b00c617c76d846164b0e0f5b9e296b31461329a
- SHA512 2f480cb5c82bbcc34e5f14084faedabd65e6233d9107d4dc7dca9822c9771d8342a61ada022c37fbf939af70c41fddc7fc46bbba47bcb6f31ebb8e1880e4887b
- TLSH
  T107119C4B061BA36E13B692A68FFE5E08F174401B36868714B4708DA4BFF99E55405CEC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  IDM/IDMFType64.dll
- Size 51KB
- SHA256 0479dda9f82192a7c8881413f8ca6a220e63a4811efadc497dbefc0f4c290441
- MD5 c976ceb4be1daf3a848c11a4adf224ba
- SHA1 9ce2b9c6a3cefb6b5be69572c0c30f87322ef145
- SHA512 3cb95b2048f5c62002656fec25c529caa6327481c0351364f1168a88583facf09631a7c20ae2fe125fd8eef422095528acf27183b242a5a36bcce45c4c327cb9
- SSDEEP 768:eak1cQ6KfFSF1F2Rcyg1wgRKZMMNbKYk4PHQBpjhXnZwPs0DDYW1MmOdbCk7v:KLwL2Rc7caIbKYrKpdJwPVDRDOlCk7v
- TLSH
  T157335B47AF318064DA478678CE5D968EA5F13C41270C73EF0B74AA45BF73BD2053962A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  background.js
- Size 30KB
- SHA256 1aee0d9bea29dbe429c25d1c856a8f6122562d7bf49ca112728bcee7da976888
- MD5 a08622da174674fd67dea8e8e38207b1
- SHA1 5636c5ea2255240f0c5872453404c510066a3328
- SHA512 5d746f0468169ed3e7569f44b60315756c6a95eb6d5c0f63d6fd7a76f57e67fcfddca82194901c184a753f76fba3e08c59b9108d2936b188ab466df0ade5165e
- SSDEEP 384:Kt0BNGCpwLg+mmu4bc1BqO7sZN0xf39L0VI/ImjVF+7tyg9jrItw97GEGxDuszfL:KuNz+mmu42AO7sQ5tlCQ0GEwDx6rQ
- TLSH
  T1E5E24CC73123345AA761A0F6981F46D6B73AB82D3448CCBDB425D4D22C7866E12BEF74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  captured.html
- Size 1KB
- SHA256 1e999f527d59a6bbe493f937cfb5230720b0da8543e276101ad3ab889dded1a7
- MD5 b9e70d1713fb37421512f2031a201136
- SHA1 3981f3339489d0412147cb809fdf75256b96d6d7
- SHA512 cb1d54a6a22a104fc0da5435c2bfd28443b4b633322a15be1a7127f55a8b3c1befd5d5316d337c5ab557d6ff5fb5e3b20b788083785b52e1b754a98886886c12
- TLSH
  T12311122F42B72C0ED6536AAEF495BB6818034140534B467531D32B6FA1F7092CE9628E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  content.js
- Size 7KB
- SHA256 8e52f5853eef47a2741494262e11bea6425ce9de8d6369b5cd0635bf45010854
- MD5 b8d2b88a9e3622c7afb968a51e55db11
- SHA1 901bce108b881bcb1feafb0c3dc60e9911928d52
- SHA512 b39b5c115216bfe2ba9491e95b0662a2abd3971b81f843feb377251751d031aca9c0abf3da588a334eafe8e6c87829d44daaf03563dfa04433ad8f11471891cb
- SSDEEP 192:12g1r2WaKS50OfjcgJkcxZSL9vdveJyOpDeTbCuAT:12Ur9aKS5jjcgucPSL9lWgOpDeTuu4
- TLSH
  T151F1A7AEB620187603E6D46ABA2BF245743714182847314CF60ED8D7BEB0FC76119F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  document.js
- Size 341B
- SHA256 37310ccfb001a6880f60f461da9b2671026f07959fbb8bdd7f44092c580cb455
- MD5 1c678f46940a7c4a579e5effadb846ab
- SHA1 2be15c40e6a99f168565675e3f131a60b25074ab
- SHA512 1ea1c425c31101b3a06cb655f50a26fee1a94c2fa18a64dd8b0700b140720e2ed6aaed6cdb3f3dbbc1ecb9bd19ef64310ebb6129bbcf3bff08c317c7ba5a5185
- TLSH
  T1B3E0C04EC3107C2404714B09F36F3B03352716455402C080531D4CD0F70AC5B8193DC9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  welcome.html
- Size 2KB
- SHA256 bdfd01cc30389fa64aad872b870a88553066f1b63deabb134d493877a4d2e57d
- MD5 cc64ffc9ff196c6b96483b603167978d
- SHA1 8e59ee8598b162ed27e7dfeacf54ebbf62187b26
- SHA512 26ba46e6aa96b2fd5e486e32ecbf7d522425825016493e65f9c3d9b1d5b5a5d8f6ae663f0975b5980a9af348a778d9bdb80a03737bd2b1853fd27720c7a58829
- TLSH
  T10D51D92E839F7C1F0033CA56E1B5E7788A22010493435331B1FB5A9B52DB562CBA52CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  welcome.js
- Size 943B
- SHA256 7b54ce4e74879280c02da884bb51b302ddb0c9bc02415631906960ec8a92fe26
- MD5 538d3643e901f087fed0b0a5e143a5f3
- SHA1 2b00c617c76d846164b0e0f5b9e296b31461329a
- SHA512 2f480cb5c82bbcc34e5f14084faedabd65e6233d9107d4dc7dca9822c9771d8342a61ada022c37fbf939af70c41fddc7fc46bbba47bcb6f31ebb8e1880e4887b
- TLSH
  T107119C4B061BA36E13B692A68FFE5E08F174401B36868714B4708DA4BFF99E55405CEC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  IDM/IDMGetAll.dll
- Size 55KB
- SHA256 5521835be4383d57445c0b273057fa7747f3df26d0c880e00108c32cf5b3cccc
- MD5 8c6af35602856595601f3cffc70317d8
- SHA1 2361961ceb030e0bb5c019a082144d5e926d8e14
- SHA512 979f3093e22b1279324e731261f7be23239ccb56264f538f6a0d8434e655e2d2abe933e000d9bc1110a4ae54374d6fe2df7337484b0d0326e126f3dbbbd842e8
- SSDEEP 768:dmIjaBc8QbbigMxZqow7Za2VzSFWFNK5g0z9dIZK99Axf8:iBJoMxZbyCaNKFz9aZO9a8
- TLSH
  T1B2436C0737E4D0F2D2CA0630A96587E597B9AF604CE2540327B276CD3E72B95E725A0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  IDM/IDMGetAll64.dll
- Size 88KB
- SHA256 e407368144b4dafe540cd09dd10500125897e59d8d25b3b1caeb2b875bdd56a7
- MD5 ac822be8ffb08e7ea2ad573b9f87ea71
- SHA1 c94d118783a6e2fcb1aed1a8742916f6d5f8d3ae
- SHA512 31bdc0c0cec36924f1f3463fc2193a22f748106d9f15bd4d302f9f34108ce99b97db96ee1bbb083a1e458462d715c8e5664829accd9241d1d6c4c440a28879a8
- SSDEEP 1536:a6QBLAjR742bHHxDWBzFUP0iB9POpfcF1n8:6QRbdEwzbPOpfcFZ8
- TLSH
  T10093295AB66880B6E051C179CEA3CA82D772BD521B21538F6661B74D2F373F25F38321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32