15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583

Sharing

Copy URL Twitter E-mail

General

Target
28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118
Size 6.5MB
Sample240509-jaslasae98
SHA256 15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583
MD5 28edcb1ff25cd616bc9709b9dded1261
SHA1 d127c38e5ba60af11f55ea919caded6f65b788c7
SHA512 3a0f7b5242bda03ec1bce572dfeb5a59a5c3aca103b04822d5eee64c63ae7bd4809ce51c190d4f5f0a12c4cb5c94e2d607ee4c5ba13093d16829fbf2e310449f
SSDEEP 98304:3//78eyjX2D3uw0axTiJ13y3AB2YfvLSioCsjNutnQBlYjEFy+u27gD2DyjU/YlL:vDGGLuw+v3JXZsjM6cQ827gD2OjFQaTP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118
- Size 6.5MB
- SHA256 15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583
- MD5 28edcb1ff25cd616bc9709b9dded1261
- SHA1 d127c38e5ba60af11f55ea919caded6f65b788c7
- SHA512 3a0f7b5242bda03ec1bce572dfeb5a59a5c3aca103b04822d5eee64c63ae7bd4809ce51c190d4f5f0a12c4cb5c94e2d607ee4c5ba13093d16829fbf2e310449f
- SSDEEP 98304:3//78eyjX2D3uw0axTiJ13y3AB2YfvLSioCsjNutnQBlYjEFy+u27gD2DyjU/YlL:vDGGLuw+v3JXZsjM6cQ827gD2OjFQaTP
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/HWSignature.dll
- Size 78KB
- SHA256 db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
- MD5 87c80914dfc65df16f5ff36040666da3
- SHA1 06aefe9570ef484a322c53297152f1ea50746878
- SHA512 bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
- SSDEEP 1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4
- MD5 6e663f1a0de94bc05d64d020da5d6f36
- SHA1 c5abb0033776d6ab1f07e5b3568f7d64f90e5b04
- SHA512 2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5
- SSDEEP 192:VsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mj8ozxGUWumle:VsUHd9GN2d2iwl0impATIPdAj8Ov6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/SetupLib.dll
- Size 2.4MB
- SHA256 ae9897c5aa08185050742ba4b982732d6b4e71565af2f94622e9bb8998f69dbb
- MD5 129db08e936fd574643aea1bb88d1459
- SHA1 147391794348b4e78c6240a7b550e01e0ae1d0fb
- SHA512 b814619f93668aac550d169bcff2b40cef39d07cb3d32d2454b3233fc459bd4ac87bf58f6d009616abb4f863c3d423f2f80e4803abc1ee064660b779ddf5472b
- SSDEEP 24576:xXSULtoXic6SrKO8yzZqL0IiurkhER/QWcihDHl3lBkqRm5cQtMOt2uzsSylJYxV:xunhWcE3lEyc8LKLMREgWE8T9T9AF8p
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/SogouPY.ime
- Size 4.9MB
- SHA256 29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
- MD5 67878eda87845d76dc5cf786568c3b5a
- SHA1 1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
- SHA512 53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
- SSDEEP 49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/SogouPY64.ime
- Size 8.3MB
- SHA256 4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
- MD5 d6bb082f1fd6edcd000e75d3822adbc8
- SHA1 04783fa76820795009ce0c2ba176e2996b9b4acc
- SHA512 4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
- SSDEEP 49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/SogouTSF.ime
- Size 1.1MB
- SHA256 500d36c3c9e11e246fd9f1e616f806a833e02ff9283152d3a94649ba08e4a602
- MD5 b6a3aa486dd89f66d2811144d4e089e2
- SHA1 931b3a5beb0ff1f1bd4a7dce4264a28e71aa3fc3
- SHA512 a759445c5a7b31574046382f3ecdb2c4a5b5d67f989cfe8bc91683161cd265e3c91c4b157ae63e06388ca903b404e35d068bc80b4b4157e01cfc5f05540614d1
- SSDEEP 24576:IXULxRXSnM/6f/M2dx5N5cxnC279V+jTi6yTxcjGHX6RF:GMi/B6C279ylyThKRF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/SogouTSF64.ime
- Size 1.8MB
- SHA256 894efa9aa999124ab5bdc3e04aab2ac31cb02258c6a814e4c758796c1ce1daf5
- MD5 9781b5a306c996fe6408686b167c6750
- SHA1 446c816ca849bd023d111acdd5cda94b7dd47099
- SHA512 bd8c55ec6cf516404a19a9bd7a6ba787fb298a39cb474322c54fa839821bbc11f96fde19f5e76c4b5042e536ecfc79386ec446356f8da0fa920b4e5f3a9b7bca
- SSDEEP 24576:oDBeZWKf0RfvAHIhMGas/wQ1d4DwE7QEOvJ1NZV5TWcj8c1es/+NrWQzI:oVeZWnACMGawdd3TEcYiUrWX
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Registers COM server for autorun
  persistence
behavioral15 behavioral16
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655
- MD5 b9f430f71c7144d8ff4ab94be2785aa6
- SHA1 c5c1e153caff7ad1d221a9acc8bbb831f05ccb05
- SHA512 c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099
- SSDEEP 192:hClej3uzvJwqJMQKN4GbeWZksMI4ETWcEbcBZ8ep2Kra7yOG:hCm2HgN4GbeWmbI4Eybogia7yO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 ca869d6c6752aa4a8a6c874a694b543442992d7e854d0c48a1b60bca01a8c8c6
- MD5 7823fc560926dcd8741de6f0b900083f
- SHA1 93dc0a704bc0b8f90668548e36daf459be0ae10a
- SHA512 c79509cd306638ea9badec64ed9f7d0690e46fcab7ac77f25134065b628e76d2812f2d874ea2cc4283685c567b613a39d27b9fc4a6de2d4b9d30131f3161c4e9
- SSDEEP 192:SzQhZDqlJcKISw99ioU3MSfwLF/+nhHUVsdz:SzoZDGKYw9goWyFGBU4z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  $SYSDIR/SogouPY.ime
- Size 8.3MB
- SHA256 4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
- MD5 d6bb082f1fd6edcd000e75d3822adbc8
- SHA1 04783fa76820795009ce0c2ba176e2996b9b4acc
- SHA512 4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
- SSDEEP 49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  $SYSDIR/SogouPY.ime~
- Size 8.3MB
- SHA256 4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
- MD5 d6bb082f1fd6edcd000e75d3822adbc8
- SHA1 04783fa76820795009ce0c2ba176e2996b9b4acc
- SHA512 4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
- SSDEEP 49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  $SYSDIR/SogouTSF.ime
- Size 1.1MB
- SHA256 500d36c3c9e11e246fd9f1e616f806a833e02ff9283152d3a94649ba08e4a602
- MD5 b6a3aa486dd89f66d2811144d4e089e2
- SHA1 931b3a5beb0ff1f1bd4a7dce4264a28e71aa3fc3
- SHA512 a759445c5a7b31574046382f3ecdb2c4a5b5d67f989cfe8bc91683161cd265e3c91c4b157ae63e06388ca903b404e35d068bc80b4b4157e01cfc5f05540614d1
- SSDEEP 24576:IXULxRXSnM/6f/M2dx5N5cxnC279V+jTi6yTxcjGHX6RF:GMi/B6C279ylyThKRF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  $_13_/HWSignature.dll
- Size 78KB
- SHA256 db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
- MD5 87c80914dfc65df16f5ff36040666da3
- SHA1 06aefe9570ef484a322c53297152f1ea50746878
- SHA512 bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
- SSDEEP 1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral27 behavioral28
- Target
  7.8.0.7088/HWSignature.dll
- Size 78KB
- SHA256 db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
- MD5 87c80914dfc65df16f5ff36040666da3
- SHA1 06aefe9570ef484a322c53297152f1ea50746878
- SHA512 bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
- SSDEEP 1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral29 behavioral30
- Target
  7.8.0.7088/SogouPY.ime
- Size 4.9MB
- SHA256 29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
- MD5 67878eda87845d76dc5cf786568c3b5a
- SHA1 1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
- SHA512 53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
- SSDEEP 49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

Writes to the Master Boot Record (MBR)

Registers COM server for autorun

Writes to the Master Boot Record (MBR)

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32