General

  • Target

    28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118

  • Size

    6.5MB

  • Sample

    240509-jaslasae98

  • MD5

    28edcb1ff25cd616bc9709b9dded1261

  • SHA1

    d127c38e5ba60af11f55ea919caded6f65b788c7

  • SHA256

    15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583

  • SHA512

    3a0f7b5242bda03ec1bce572dfeb5a59a5c3aca103b04822d5eee64c63ae7bd4809ce51c190d4f5f0a12c4cb5c94e2d607ee4c5ba13093d16829fbf2e310449f

  • SSDEEP

    98304:3//78eyjX2D3uw0axTiJ13y3AB2YfvLSioCsjNutnQBlYjEFy+u27gD2DyjU/YlL:vDGGLuw+v3JXZsjM6cQ827gD2OjFQaTP

Malware Config

Targets

    • Target

      28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118

    • Size

      6.5MB

    • MD5

      28edcb1ff25cd616bc9709b9dded1261

    • SHA1

      d127c38e5ba60af11f55ea919caded6f65b788c7

    • SHA256

      15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583

    • SHA512

      3a0f7b5242bda03ec1bce572dfeb5a59a5c3aca103b04822d5eee64c63ae7bd4809ce51c190d4f5f0a12c4cb5c94e2d607ee4c5ba13093d16829fbf2e310449f

    • SSDEEP

      98304:3//78eyjX2D3uw0axTiJ13y3AB2YfvLSioCsjNutnQBlYjEFy+u27gD2DyjU/YlL:vDGGLuw+v3JXZsjM6cQ827gD2OjFQaTP

    Score
    7/10
    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      $PLUGINSDIR/HWSignature.dll

    • Size

      78KB

    • MD5

      87c80914dfc65df16f5ff36040666da3

    • SHA1

      06aefe9570ef484a322c53297152f1ea50746878

    • SHA256

      db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e

    • SHA512

      bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f

    • SSDEEP

      1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM

    Score
    6/10
    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      15KB

    • MD5

      6e663f1a0de94bc05d64d020da5d6f36

    • SHA1

      c5abb0033776d6ab1f07e5b3568f7d64f90e5b04

    • SHA256

      458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4

    • SHA512

      2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5

    • SSDEEP

      192:VsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mj8ozxGUWumle:VsUHd9GN2d2iwl0impATIPdAj8Ov6

    Score
    3/10
    • Target

      $PLUGINSDIR/SetupLib.dll

    • Size

      2.4MB

    • MD5

      129db08e936fd574643aea1bb88d1459

    • SHA1

      147391794348b4e78c6240a7b550e01e0ae1d0fb

    • SHA256

      ae9897c5aa08185050742ba4b982732d6b4e71565af2f94622e9bb8998f69dbb

    • SHA512

      b814619f93668aac550d169bcff2b40cef39d07cb3d32d2454b3233fc459bd4ac87bf58f6d009616abb4f863c3d423f2f80e4803abc1ee064660b779ddf5472b

    • SSDEEP

      24576:xXSULtoXic6SrKO8yzZqL0IiurkhER/QWcihDHl3lBkqRm5cQtMOt2uzsSylJYxV:xunhWcE3lEyc8LKLMREgWE8T9T9AF8p

    Score
    3/10
    • Target

      $PLUGINSDIR/SogouPY.ime

    • Size

      4.9MB

    • MD5

      67878eda87845d76dc5cf786568c3b5a

    • SHA1

      1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b

    • SHA256

      29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716

    • SHA512

      53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0

    • SSDEEP

      49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY

    Score
    1/10
    • Target

      $PLUGINSDIR/SogouPY64.ime

    • Size

      8.3MB

    • MD5

      d6bb082f1fd6edcd000e75d3822adbc8

    • SHA1

      04783fa76820795009ce0c2ba176e2996b9b4acc

    • SHA256

      4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa

    • SHA512

      4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009

    • SSDEEP

      49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4

    Score
    1/10
    • Target

      $PLUGINSDIR/SogouTSF.ime

    • Size

      1.1MB

    • MD5

      b6a3aa486dd89f66d2811144d4e089e2

    • SHA1

      931b3a5beb0ff1f1bd4a7dce4264a28e71aa3fc3

    • SHA256

      500d36c3c9e11e246fd9f1e616f806a833e02ff9283152d3a94649ba08e4a602

    • SHA512

      a759445c5a7b31574046382f3ecdb2c4a5b5d67f989cfe8bc91683161cd265e3c91c4b157ae63e06388ca903b404e35d068bc80b4b4157e01cfc5f05540614d1

    • SSDEEP

      24576:IXULxRXSnM/6f/M2dx5N5cxnC279V+jTi6yTxcjGHX6RF:GMi/B6C279ylyThKRF

    Score
    1/10
    • Target

      $PLUGINSDIR/SogouTSF64.ime

    • Size

      1.8MB

    • MD5

      9781b5a306c996fe6408686b167c6750

    • SHA1

      446c816ca849bd023d111acdd5cda94b7dd47099

    • SHA256

      894efa9aa999124ab5bdc3e04aab2ac31cb02258c6a814e4c758796c1ce1daf5

    • SHA512

      bd8c55ec6cf516404a19a9bd7a6ba787fb298a39cb474322c54fa839821bbc11f96fde19f5e76c4b5042e536ecfc79386ec446356f8da0fa920b4e5f3a9b7bca

    • SSDEEP

      24576:oDBeZWKf0RfvAHIhMGas/wQ1d4DwE7QEOvJ1NZV5TWcj8c1es/+NrWQzI:oVeZWnACMGawdd3TEcYiUrWX

    Score
    7/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      b9f430f71c7144d8ff4ab94be2785aa6

    • SHA1

      c5c1e153caff7ad1d221a9acc8bbb831f05ccb05

    • SHA256

      b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655

    • SHA512

      c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

    • SSDEEP

      192:hClej3uzvJwqJMQKN4GbeWZksMI4ETWcEbcBZ8ep2Kra7yOG:hCm2HgN4GbeWmbI4Eybogia7yO

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      7823fc560926dcd8741de6f0b900083f

    • SHA1

      93dc0a704bc0b8f90668548e36daf459be0ae10a

    • SHA256

      ca869d6c6752aa4a8a6c874a694b543442992d7e854d0c48a1b60bca01a8c8c6

    • SHA512

      c79509cd306638ea9badec64ed9f7d0690e46fcab7ac77f25134065b628e76d2812f2d874ea2cc4283685c567b613a39d27b9fc4a6de2d4b9d30131f3161c4e9

    • SSDEEP

      192:SzQhZDqlJcKISw99ioU3MSfwLF/+nhHUVsdz:SzoZDGKYw9goWyFGBU4z

    Score
    3/10
    • Target

      $SYSDIR/SogouPY.ime

    • Size

      8.3MB

    • MD5

      d6bb082f1fd6edcd000e75d3822adbc8

    • SHA1

      04783fa76820795009ce0c2ba176e2996b9b4acc

    • SHA256

      4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa

    • SHA512

      4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009

    • SSDEEP

      49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4

    Score
    1/10
    • Target

      $SYSDIR/SogouPY.ime~

    • Size

      8.3MB

    • MD5

      d6bb082f1fd6edcd000e75d3822adbc8

    • SHA1

      04783fa76820795009ce0c2ba176e2996b9b4acc

    • SHA256

      4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa

    • SHA512

      4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009

    • SSDEEP

      49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4

    Score
    1/10
    • Target

      $SYSDIR/SogouTSF.ime

    • Size

      1.1MB

    • MD5

      b6a3aa486dd89f66d2811144d4e089e2

    • SHA1

      931b3a5beb0ff1f1bd4a7dce4264a28e71aa3fc3

    • SHA256

      500d36c3c9e11e246fd9f1e616f806a833e02ff9283152d3a94649ba08e4a602

    • SHA512

      a759445c5a7b31574046382f3ecdb2c4a5b5d67f989cfe8bc91683161cd265e3c91c4b157ae63e06388ca903b404e35d068bc80b4b4157e01cfc5f05540614d1

    • SSDEEP

      24576:IXULxRXSnM/6f/M2dx5N5cxnC279V+jTi6yTxcjGHX6RF:GMi/B6C279ylyThKRF

    Score
    1/10
    • Target

      $_13_/HWSignature.dll

    • Size

      78KB

    • MD5

      87c80914dfc65df16f5ff36040666da3

    • SHA1

      06aefe9570ef484a322c53297152f1ea50746878

    • SHA256

      db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e

    • SHA512

      bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f

    • SSDEEP

      1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM

    Score
    6/10
    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      7.8.0.7088/HWSignature.dll

    • Size

      78KB

    • MD5

      87c80914dfc65df16f5ff36040666da3

    • SHA1

      06aefe9570ef484a322c53297152f1ea50746878

    • SHA256

      db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e

    • SHA512

      bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f

    • SSDEEP

      1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM

    Score
    6/10
    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      7.8.0.7088/SogouPY.ime

    • Size

      4.9MB

    • MD5

      67878eda87845d76dc5cf786568c3b5a

    • SHA1

      1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b

    • SHA256

      29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716

    • SHA512

      53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0

    • SSDEEP

      49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

upx
Score
7/10

behavioral2

upx
Score
7/10

behavioral3

bootkitpersistence
Score
6/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

persistence
Score
7/10

behavioral16

Score
1/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

bootkitpersistence
Score
6/10

behavioral28

Score
3/10

behavioral29

bootkitpersistence
Score
6/10

behavioral30

Score
3/10

behavioral31

Score
1/10

behavioral32

Score
1/10