27f31860fd9f2a5b127f0d13972cd0a9d3f589a9add6fa0d7feac606f2a7cb5b

Sharing

Copy URL Twitter E-mail

General

Target
e692a9014378ac46f150b9122698776c_JaffaCakes118
Size 3.6MB
Sample240408-eepyraga24
SHA256 27f31860fd9f2a5b127f0d13972cd0a9d3f589a9add6fa0d7feac606f2a7cb5b
MD5 e692a9014378ac46f150b9122698776c
SHA1 7a7bdb86c86e1e1adff07c43b1134479395f0eb3
SHA512 84687887ac68843c8cd465fd0fc3674e18954c14bd21ed665390080ed9c93462958cdf770309e4c3ffb93ba18db965d8d35c18e57023351ea50994b31a2c0b91
SSDEEP 98304:u84pGEbRzNwJt+YuNHIbGhyk/5rX1UUk38NAg2uvN2n8ibIxH3:uH0EVNw6hH0GT/h1UU4+AgvvN2n8JX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  e692a9014378ac46f150b9122698776c_JaffaCakes118
- Size 3.6MB
- SHA256 27f31860fd9f2a5b127f0d13972cd0a9d3f589a9add6fa0d7feac606f2a7cb5b
- MD5 e692a9014378ac46f150b9122698776c
- SHA1 7a7bdb86c86e1e1adff07c43b1134479395f0eb3
- SHA512 84687887ac68843c8cd465fd0fc3674e18954c14bd21ed665390080ed9c93462958cdf770309e4c3ffb93ba18db965d8d35c18e57023351ea50994b31a2c0b91
- SSDEEP 98304:u84pGEbRzNwJt+YuNHIbGhyk/5rX1UUk38NAg2uvN2n8ibIxH3:uH0EVNw6hH0GT/h1UU4+AgvvN2n8JX
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InetLoad.dll
- Size 18KB
- SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
- MD5 994669c5737b25c26642c94180e92fa2
- SHA1 d8a1836914a446b0e06881ce1be8631554adafde
- SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
- SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/md5dll.dll
- Size 6KB
- SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
- MD5 0745ff646f5af1f1cdd784c06f40fce9
- SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
- SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
- SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  $TEMP/MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe
- Size 3.8MB
- SHA256 da0e716af146e66e9e5aeeafc46ab2c2b81bc29fb800a2ac2816af537b03b240
- MD5 d04de47cbf06e4e9322ea1268bc77c43
- SHA1 0b396c9e758f7105ac583f76098127cc0e01257f
- SHA512 97bfb09df4d929d2877dfd6636fc224437d0ae9843a58f5958792bcab63d5f22585fb5f341a8899c9736b340c4e92afc8ccf43f18b80dc204228fc0d2349b7ea
- SSDEEP 98304:zn9tKv0LOG2APYwMrexUIk8wNDFmpvntLfs1I0:bazTw5xUIPSDFivntLfE
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware discovery evasion persistence spyware stealer trojan
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  $TEMP/marker.exe
- Size 26KB
- SHA256 ad18f4d54a6e66803a803bb4abf0e42a151f241187292896721db92f89b8c699
- MD5 3574d43b65ee01ed65b55864f2cad92e
- SHA1 caeaddac7f3d011ad0307a5ba60080ef8537273b
- SHA512 78864a17aef8033f4dfe446d3d38dd9f68fcd9ca99f0dacb0e16ddc4ff4ce7e12a637b847154f8793dd3cc22139c6ee5a5e0b47058c898cd9979d339e6c66e44
- SSDEEP 384:MghHO6uSpYUDNmjoqwe5naRjpv/GvAIr0XYgPGspZJJP:3u69YmSopon41/GvcvLp3J
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  SkyMonk.exe
- Size 356KB
- SHA256 8db3335687786fe49d57afbb85dcbfd0ed67b04a590878650ed1bc6b3842dc31
- MD5 28ea6cf6cb79d3125d29e2182b9c6645
- SHA1 22e506e9a0f10edf4e07e7b8f4cd3f3c6f8af2dc
- SHA512 d8bbfc048990379ec1728798f81a9f15437b8f409bacf78d9fb562e69a8d29193cb6a9d06f6687b58fdd8bcca5884f71d99f3eda93f60684f0bf5f585a5821ac
- SSDEEP 6144:WvtRXA3uutOEBwnJu31gLZngBjHcT3hgrFR3HIgGu6YIixPmaRER4L:Wvt1A0+CL6j8T30Fr6+tNg4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  english.loc
- Size 124KB
- SHA256 a74fff8cf7715d451b6a20f5eaf9a10c9cd56485a7aea68b2726820942365678
- MD5 c70a623400a7091a295b9295dec302b4
- SHA1 7110b7c1057575129ebabb018eed40f8a1829b6c
- SHA512 526414b202e60c40189dec18da87f13ee4a1e898267f6d5dcd69cb20e2bc5fdf0aff9ed42d2a7dc3842b7c9424159c2bdc5531da93e855cf0ca5797a99630d3b
- SSDEEP 1536:zCOcV/47UNMvmN0Lsp4dhGYCf1W9o85sx9pAjTIqcGalVVH4EatQsk5A:m/47J67pYmfAV5sxutNalTH4Dk5A
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  filter.dll
- Size 20KB
- SHA256 e8787daa3236127fbbe2cbbca59a868a4495564a9ebb7d7befe73af9e38e4791
- MD5 c9b4e862c632c0c211b256160e69b5e1
- SHA1 b90b5e24ac1dbe7993e469e73dd0ce9c961489eb
- SHA512 7d79ab82bec938b770f315a67dcb34623bb0771c98eebbc41c362e6d28452372aa7d7bc17b6b983e0b2056d9d6bda770b6c0e50f47501d6a65e22fe42d1a1450
- SSDEEP 384:xALph75y5qkKm/+0eES5f0RybqKkfrbmak6bRUfRsVZtXos:xkh0h+03S5f0AQrrkROPtd
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  russian.loc
- Size 124KB
- SHA256 9900a23bf7d7f4b5e9343b6f37a8406ddeb302ebe1d9fcf382b1c408b7dc36e7
- MD5 f8d4f0bc57b49287b04ed40a4c68d2ea
- SHA1 9d38d930eeaa710ef1ad6da16456563d3b008b4f
- SHA512 1c02fde05d653e187371b1757616173b6278f7447ec18f1103be76daa5868f70dc67b5e1a35faaddae6f6c0ecdafcf6ab9c23ecb849757764cb8fec96b3f60ea
- SSDEEP 1536:IH1COcV/476GMfQmthLlHu52bAig/y37B2wpAjTiqcGalVVe4EafQsk5A:KA/47iLl9Uici7GLNalTe4lk5A
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  uninstall.exe
- Size 90KB
- SHA256 afb14aee4127f0e4f662d0ade3efede48ea54045e422ca26e08024a60dc972b4
- MD5 16c86ad4d25b228930ff1019e4e3292f
- SHA1 3ce7ad87f8210564399dd28f5413b8c450dd7b14
- SHA512 0bacd4ea9fb0c741dd5ae4f8560a16efbf7d1dc2fe6fbeedc11a0a0112d2137bdce491b41a0d64a39f8ab5261829dae5cc3cb0f274780deeb061db365f93db7d
- SSDEEP 1536:1pgpHzb9dZVX9fHMvG0D3XJPMzKO5b4ae3z7FDYV5R9AcVVMncJGjef2od:ngXdZt9P6D3XJPqKO5e/FDeFjVOntiO0
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral25 behavioral26
- Target
  $PLUGINSDIR/InetLoad.dll
- Size 18KB
- SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
- MD5 994669c5737b25c26642c94180e92fa2
- SHA1 d8a1836914a446b0e06881ce1be8631554adafde
- SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
- SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral29 behavioral30
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- MD5 SHA1 SHA512
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

UPX packed file

ACProtect 1.3x - 1.4x DLL software

UPX packed file

Modifies Windows Firewall

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Installs/modifies Browser Helper Object

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32