Overview

overview

7

Static

static

3

82f26b74d7...25.exe

windows7-x64

7

82f26b74d7...25.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

ffMediaWat...ion.js

windows7-x64

3

ffMediaWat...ion.js

windows10-2004-x64

3

ff/chrome/...067.js

windows7-x64

3

ff/chrome/...067.js

windows10-2004-x64

3

ff/chrome/...ion.js

windows7-x64

3

ff/chrome/...ion.js

windows10-2004-x64

3

ie/MediaWa...67.dll

windows7-x64

6

ie/MediaWa...67.dll

windows10-2004-x64

6

uninstall.exe

windows7-x64

3

uninstall.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225

  • Size

    634KB

  • Sample

    240629-289xcayfra

  • MD5

    a62916f75223f51b58d8189d28453c1d

  • SHA1

    3cd82c114d70fa3c0b2d13c261f401d5cb328968

  • SHA256

    82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225

  • SHA512

    ece155c9ecac6ba00991b90b7f4103ce76c3c487b2326c0818e8c2b1b9f64742179657e82f65c366b293ff852d97ca7e112e31e9233f4073beb7aa475d30403d

  • SSDEEP

    12288:x4sqaIh+G4GjeZHkwuPikQ7lKH5p5H9x15eZHkwuXiZQblKh5pDxXTd8zbW:xlxG4GjeZEXi37l6Br15eZEviObl2rlh

Score
7/10
adwarediscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225

    • Size

      634KB

    • MD5

      a62916f75223f51b58d8189d28453c1d

    • SHA1

      3cd82c114d70fa3c0b2d13c261f401d5cb328968

    • SHA256

      82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225

    • SHA512

      ece155c9ecac6ba00991b90b7f4103ce76c3c487b2326c0818e8c2b1b9f64742179657e82f65c366b293ff852d97ca7e112e31e9233f4073beb7aa475d30403d

    • SSDEEP

      12288:x4sqaIh+G4GjeZHkwuPikQ7lKH5p5H9x15eZHkwuXiZQblKh5pDxXTd8zbW:xlxG4GjeZEXi37l6Br15eZEviObl2rlh

    Score
    7/10
    adwarediscoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      559KB

    • MD5

      51ba1095f0ae45a2d444bea506cb9ad4

    • SHA1

      038a5d53d055a6d440bd2c8864c2f51db206c5e5

    • SHA256

      b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539

    • SHA512

      f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361

    • SSDEEP

      12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN

    Score
    3/10
    behavioral3behavioral4

    • Target

      ffMediaWatchV1home3067chaction.js

    • Size

      834B

    • MD5

      09e188321d82c494bdd2a784d61abbeb

    • SHA1

      484e2e3472ca870a2468b057758ea895afdc8e79

    • SHA256

      8c39736a8812a4f0e202611f2c829d7b34a0cc77cde74505155999ef61752a18

    • SHA512

      229e3a94079ea8bbf797e34e93e85124877502e845db679bd6debedc38d07f788212116376933350a23f67bc19b19ebf439f0a75c73d902e5317e56664f1eca0

    Score
    3/10
    execution
    behavioral5behavioral6

    • Target

      ff/chrome/content/ffMediaWatchV1home3067.js

    • Size

      747B

    • MD5

      177eadd410093f73fc96c04ffdaa26d1

    • SHA1

      71b72a0b79c04f0ea9df6cea2238f0e3193499d2

    • SHA256

      d54c806de5d1f57a4cf5e463d3f51ace3c53c2854a57f363964e6c2b1765f9c0

    • SHA512

      b3a28a827a9c3edfa1a7215700da0befbcce67af2007f4b525c9100d4657261ae7108d4153cc2b437b961e0f99ca1843c75ec4a9fa1be96831653ebea252c5b9

    Score
    3/10
    execution
    behavioral7behavioral8

    • Target

      ff/chrome/content/ffMediaWatchV1home3067ffaction.js

    • Size

      678B

    • MD5

      0a69576e9d02a1988e58f82ed3c5051e

    • SHA1

      960c5f77510053290a1588b5cdb6523dc7b6a516

    • SHA256

      a30e0f29651c10a74a6dd6aba5ce0e4d0f594fa8df57f9ef041cc5a87bc13e9d

    • SHA512

      f0afa8afcd6eb4185058f9ed86719e70767872c0524ff557379076b3137878276edaefa8f7a211280aa194e592593e76edff1f8670cb3519f5bccf31cedbae02

    Score
    3/10
    execution
    behavioral10behavioral9

    • Target

      ie/MediaWatchV1home3067.dll

    • Size

      85KB

    • MD5

      884a0836632d534cfab902fcef21595c

    • SHA1

      449dba152c3e801a58af2c6f531eb84edbd9d1ba

    • SHA256

      345b7dd2d8cd5696f9e4af75b4d0b61a0462bdc780d4c93321c1f2ec858ea4c1

    • SHA512

      e4adcc9dd2d686570e5249d68b9e48eb03851ef5915e2097e874ded51ffaf116752ae1a77cd72e46c9c180606b89b9999fe5e988a9dfaed225397a1a0d6d0538

    • SSDEEP

      1536:e8/1CsEmka04RhRtahrOb8Dkhw6HA9glQMbdx:p12mka0ElahrOc6guaMbd

    Score
    6/10
    adwarestealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral11behavioral12

    • Target

      uninstall.exe

    • Size

      34KB

    • MD5

      c139fdf06d4fd5dadf56e679b62c2f21

    • SHA1

      35c3a5ac4eb5a92c8a673899ba69fad41cf300b7

    • SHA256

      b22c90eac1541e2f339e9a9963594696fdef943fe92335b805fde0885662742c

    • SHA512

      e02c3747d6176581c16aa6610e08ded569596e348179fc885cb80a7d2ac65e874ae6e69786e25088098dcd195a7182eac805da8de92f01b41f463db726c5b0e3

    • SSDEEP

      768:+HJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJRWLJRnb:+pgpHzb9dZVX9fHMvG0D3XJRWH

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

3
T1059.007

Persistence

Browser Extensions

2
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks