1ea585df6f645b042a45ed68110886bc83434e7d5415d194ba7cc7902f3f025d

Sharing

Copy URL

Twitter E-mail

General

Target

0069e3364cfb74449328531ae4a3d6d2_JaffaCakes118
Size

1.0MB
Sample

240426-ksg3ysda6w
MD5

0069e3364cfb74449328531ae4a3d6d2
SHA1

49bc16b1385ea330c74189537c3a619061b24b28
SHA256

1ea585df6f645b042a45ed68110886bc83434e7d5415d194ba7cc7902f3f025d
SHA512

a9ef50b7634acce01b2836ccb43237770bfb44da1aa96473a27de2aa1f7a8caa2117e03dc2a28268d3434004ba002ae88a37eedde5b64d19e66697da90ae897c
SSDEEP

24576:zkMabKuaz/AxGLwRWWvj0u0tfIco9bzuJ:zRXuG/AoLwRvF0tfIj9fe

Score

8^/10

adware stealer

Malware Config

Targets

- Target
  
  0069e3364cfb74449328531ae4a3d6d2_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  0069e3364cfb74449328531ae4a3d6d2
- SHA1
  
  49bc16b1385ea330c74189537c3a619061b24b28
- SHA256
  
  1ea585df6f645b042a45ed68110886bc83434e7d5415d194ba7cc7902f3f025d
- SHA512
  
  a9ef50b7634acce01b2836ccb43237770bfb44da1aa96473a27de2aa1f7a8caa2117e03dc2a28268d3434004ba002ae88a37eedde5b64d19e66697da90ae897c
- SSDEEP
  
  24576:zkMabKuaz/AxGLwRWWvj0u0tfIco9bzuJ:zRXuG/AoLwRvF0tfIj9fe
Score

3^/10
behavioral1 behavioral2
- Target
  
  $COMMONFILES/Angels/AgLog.dll.tmp
- Size
  
  298KB
- MD5
  
  eac8960e017bd934b2009f6db2faf03c
- SHA1
  
  709263b55e8002c9acde39ff48eb9b43486d5ec6
- SHA256
  
  5b432e3255dc73277356571855cb782d3a376c9d2a77eec940092853b68319fb
- SHA512
  
  2c27493d946f3696c200b3c8db9bb698a6d8e2dcc8ad94304ca7c34b5d4fd40c735214691dcd294923515831da818a482d4821d0e0b92d162b8734ba07c9e6e5
- SSDEEP
  
  6144:BCv6QXUtiBav//wX4Yz0jfTc3B3QvZusUhm:IPi/wX4YzYfTchQhu0
Score

4^/10
behavioral3 behavioral4
- Target
  
  $COMMONFILES/Angels/IEHelp.htm.tmp
- Size
  
  932B
- MD5
  
  4e72a0d4ecf37f91b9fc9fd2e27a6661
- SHA1
  
  c3e9117731947e1a3e2f9aaea9356cedf5fe53da
- SHA256
  
  609471ce7403a914ef23d91082242c876e1b2ffcfcc6a70ab1309f45b387d1d4
- SHA512
  
  ffc517b819c9e995f0aadef0583b099b16bff262315a9f27ba1c6306d0e0fde30c32ecaac19fdaf9584f182b64677699b42d40606f4038637485b2b5601d79bb
Score

1^/10
behavioral5 behavioral6
- Target
  
  $COMMONFILES/Angels/Scan.dll.tmp
- Size
  
  1.1MB
- MD5
  
  2af0fae7be350e43a1edd7f2035fb683
- SHA1
  
  d1d989838c011da7c9c05023a9c3cca62ba9c6be
- SHA256
  
  f27ac14c430bf9f5e16bef3fc7c68a250e8b1f5ff2c9198dd7d8d909a0bafc60
- SHA512
  
  654d29ca12a03755f5897079962170fc3e35cce5da1150770789f4101c090126da032e8b124f642842844193dfc3758b93358c7f490bbdda5bcf47f70bfd97ba
- SSDEEP
  
  24576:TgcIwdCFEXGwz6Ff78H8KZ7SI7ErlB6azPTkkkkkkkkkkkkkkUkkkkkkkkkkkkk+:TgcIwi5nQ24Erer
Score

8^/10
- Blocklisted process makes network request
behavioral7 behavioral8
- Target
  
  $COMMONFILES/Angels/aggame.exe.tmp
- Size
  
  52KB
- MD5
  
  1584925f28b9aa33eabea49257cb5e49
- SHA1
  
  929265245c2be1a89579a3ddff1efd26948a06e2
- SHA256
  
  1fe86fadbac1ece2d2ea78c00fd07c53199ffed3300821e6e83ad526e4b6cf72
- SHA512
  
  28a092d2db2a866f7396ca0cdfa38ede0adfbf5fabcfbb95c204bdc364b83d7dd994f890effd6d21a33d3fcfc1d1e6816c57638609866754334541dfde621123
- SSDEEP
  
  1536:yg9ZqVQPN4UmcCnhfvR8q+yDhb87ZFAuJJ25xa4QGD:yPccDhfrVewxxj
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  
  $COMMONFILES/Angels/go114fa.exe.tmp
- Size
  
  26KB
- MD5
  
  be4cb0b0f6b6b2392e4df25ac7a1ab60
- SHA1
  
  445d5b3ad9d14231caa5db1b2d899f37430a63c1
- SHA256
  
  5b1a692e365eaa612e11e4f7161b2e2223b3f8171a18516368d646c16bd53e2c
- SHA512
  
  fce748853a7f2e524f60c03b6587349c09211648978a9470c9980976b8830d0689a2876f60a6358f5dd8c5d886325b75ace982679ecaf6f9863a96d5d1a00646
- SSDEEP
  
  768:JicxqkQ0OJQSf5Q4bDb87SSFAuJJ2m81LLEUbGNl:wcxqkQOYDb87ZFAuJJ2z4QGNl
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  31KB
- MD5
  
  83cd62eab980e3d64c131799608c8371
- SHA1
  
  5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA256
  
  a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- SHA512
  
  91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP
  
  384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
Score

3^/10
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  32KB
- MD5
  
  83142eac84475f4ca889c73f10d9c179
- SHA1
  
  dbe43c0de8ef881466bd74861b2e5b17598b5ce8
- SHA256
  
  ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
- SHA512
  
  1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
- SSDEEP
  
  384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
Score

3^/10
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  ab73c0c2a23f913eabdc4cb24b75cbad
- SHA1
  
  6569d2863d54c88dcf57c843fc310f6d9571a41e
- SHA256
  
  3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
- SHA512
  
  99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
- SSDEEP
  
  96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
Score

3^/10
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/nsWebEx.dll
- Size
  
  296KB
- MD5
  
  cc329d5153c6b5949ee9dcedb12926ab
- SHA1
  
  75744729739a8db546c08102dde407574d592a3b
- SHA256
  
  0974e41b380a2e6fa080b04b7558d12e92d5d0885edf6025b7d0000201de59da
- SHA512
  
  42b511bcbc639b6d6b3f657830a56c287d30a9ea0fbb5e63ec1db21bfcbd403a3fb3400f59ed94970fc4a71ca0830749a3f2a3190399c6e596413bba876a0b2e
- SSDEEP
  
  3072:pdVMcUtREsBESl+4+dTqQkkc6ncSQ9vyw8gekwvegplJwwwwww6pZaELk5dnD:xMcUjpBrAnTqdKcS0Hwjl2JwbD
Score

3^/10
behavioral21 behavioral22
- Target
  
  $TEMP/updatesafe.exe
- Size
  
  79KB
- MD5
  
  a53ceb8b5a3d9ee90de6370432327d83
- SHA1
  
  a50dbc458d2f29c6b83ea927211c49b87bb66358
- SHA256
  
  57daec3419ce1e392341d343004a31f5fe474e728126ae78b0281098d523199b
- SHA512
  
  c7eda4f87c6d1f91e27e7a38390972d056a2253c40439d65a39a8c995d2b8a56dc95c75a18825626d29fc65bebcc85e07bf2a0b2b191b259647b4865d015a8e4
- SSDEEP
  
  1536:NgeIePh5nmOJ9R46UUhL8tc9/28hkl4O6VI/sQkMm+V4gg4QGa:NiQbvcqhL8i8sQkMm+V4gQ
Score

1^/10
behavioral23 behavioral24
- Target
  
  IEProt/IEProt2.exe.tmp
- Size
  
  3.5MB
- MD5
  
  574e54eefb0f53f7253429de9ab66db2
- SHA1
  
  366721c3c21f9c0f93451610b5bf6a47a3fe488e
- SHA256
  
  1479e16624a4934a5aac192236306f70cb011127ea6a8ecb1ccd79c1901526bf
- SHA512
  
  305f7ffb4b53fc8ec3df1f13f6490dbac7c1758b80ac70bcda1d7fc06bf4cdb25b053c0356b5fd8bc7e17946366f6cc7ea7ffefec8f0f37260a264f6ccde0428
- SSDEEP
  
  12288:cNRlV7wz+YrPM/MuEXA3KTdWghkXATZIu:cNDVaFKEXIK4SIu
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral25 behavioral26

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Targets

Blocklisted process makes network request

Checks computer location settings

Installs/modifies Browser Helper Object

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26