General

  • Target

    ede47a5ef884b6f4c300f4d8a5615be7_JaffaCakes118

  • Size

    2.7MB

  • MD5

    ede47a5ef884b6f4c300f4d8a5615be7

  • SHA1

    d540c43dc2d563e459a94215f08d92fc977d89b9

  • SHA256

    3c18c2d34ae50722f32f61d4ee82270914b3fda0ab5a3c093f2bd2ba8a0b33f0

  • SHA512

    23fe54062701ef0e88e7d27cb7323cb4fe7837beab5ad48ca06ebcefa6b45331308c0c9ac202d0241f55c8d1669c8d6ff00aa79091ee1d6ebf60df6442a75c66

  • SSDEEP

    49152:XRCxraEbdQJzpBZCyq7ycj0/yzgmsdG1J6UKdOKLqSh7OYtFW3E:hCwEszcyqWL5msdnUKrOSh7nME

Score
10/10

Malware Config

Signatures

  • Detect Lumma Stealer payload V4 1 IoCs
  • Lumma family
  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • ede47a5ef884b6f4c300f4d8a5615be7_JaffaCakes118
    .rar
  • PPMate/!)卸载.bat
  • PPMate/!)绿化.bat
  • PPMate/PPMNet.exe
    .exe windows:4 windows x86 arch:x86

    ee1df67d522aa8016e9c02a656843980


    Code Sign

    Headers

    Imports

    Sections

  • PPMate/PPMPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d73d55c7d0f60b0b27dfc71c0880385c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMate/PSNetwork.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PPMate/PowerPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PPMate/RecordPlan.exe
    .exe windows:4 windows x86 arch:x86

    0c002c2c1c5729e7133e586d5b77fd73


    Headers

    Imports

    Sections

  • PPMate/Recorder.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4316aaef3652b911b4a625e3bab765b1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMate/TVUAx.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    29fb99baff583352fc14c8c791be329b


    Headers

    Imports

    Exports

    Sections

  • PPMate/dllcheck.exe
    .exe windows:4 windows x86 arch:x86

    7bc47012256ec9788e27c7c27c1ce1c1


    Headers

    Imports

    Sections

  • PPMate/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • PPMate/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • PPMate/network.dll
    .dll windows:4 windows x86 arch:x86

    a7ecca27bc48740abd24610fd00e04bd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMate/plugin/CheckOS.dll
    .dll windows:4 windows x86 arch:x86

    0bd51211f1803ff41ceed9ab8c00dbdd


    Headers

    Imports

    Exports

    Sections

  • PPMate/ppdoctor.exe
    .exe windows:4 windows x86 arch:x86

    462eabe3a4afd28bcef939ab08a6b8b4


    Code Sign

    Headers

    Imports

    Sections

  • PPMate/pplivesession.dll
    .dll windows:4 windows x86 arch:x86

    49732021d5d66ecf1993daccd8d373cf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMate/ppmate.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    a0944c2fb20de2459834c2cabd2598a1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMate/ppmate.exe
    .exe windows:4 windows x86 arch:x86

    93dfe6a28611c7ae00a6530619585981


    Code Sign

    Headers

    Imports

    Sections

  • PPMate/ppmlist.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    3a2edaa0cad5d25096ddec630117df5e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMate/ppstreamsession.dll
    .dll windows:4 windows x86 arch:x86

    155389df29ac066fea2486418dc21303


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMate/tvuplayersession.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    cc8c4f99ec1bd6abad69c5c27a4c5ae6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMate/version.ini
  • PPMate/xpsp2tcppatch.exe
    .exe windows:4 windows x86 arch:x86

    52208d004a89bc8f2b0dc87d13a97979


    Code Sign

    Headers

    Imports

    Sections

  • PPMate/安装说明.url
    .url