Overview
overview
7Static
static
728edcb1ff2...18.exe
windows7-x64
728edcb1ff2...18.exe
windows10-2004-x64
7$PLUGINSDI...re.dll
windows7-x64
6$PLUGINSDI...re.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ib.dll
windows7-x64
3$PLUGINSDI...ib.dll
windows10-2004-x64
3$PLUGINSDI...PY.dll
windows7-x64
1$PLUGINSDI...PY.dll
windows10-2004-x64
1$PLUGINSDI...64.dll
windows7-x64
1$PLUGINSDI...64.dll
windows10-2004-x64
1$PLUGINSDI...SF.dll
windows7-x64
1$PLUGINSDI...SF.dll
windows10-2004-x64
1$PLUGINSDI...64.dll
windows7-x64
7$PLUGINSDI...64.dll
windows10-2004-x64
$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$SYSDIR/SogouPY.dll
windows7-x64
1$SYSDIR/SogouPY.dll
windows10-2004-x64
1$SYSDIR/SogouPY.dll
windows7-x64
1$SYSDIR/SogouPY.dll
windows10-2004-x64
1$SYSDIR/SogouTSF.dll
windows7-x64
1$SYSDIR/SogouTSF.dll
windows10-2004-x64
1$_13_/HWSignature.dll
windows7-x64
6$_13_/HWSignature.dll
windows10-2004-x64
37.8.0.7088...re.dll
windows7-x64
67.8.0.7088...re.dll
windows10-2004-x64
37.8.0.7088...PY.dll
windows7-x64
17.8.0.7088...PY.dll
windows10-2004-x64
1General
-
Target
28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118
-
Size
6.5MB
-
Sample
240509-jaslasae98
-
MD5
28edcb1ff25cd616bc9709b9dded1261
-
SHA1
d127c38e5ba60af11f55ea919caded6f65b788c7
-
SHA256
15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583
-
SHA512
3a0f7b5242bda03ec1bce572dfeb5a59a5c3aca103b04822d5eee64c63ae7bd4809ce51c190d4f5f0a12c4cb5c94e2d607ee4c5ba13093d16829fbf2e310449f
-
SSDEEP
98304:3//78eyjX2D3uw0axTiJ13y3AB2YfvLSioCsjNutnQBlYjEFy+u27gD2DyjU/YlL:vDGGLuw+v3JXZsjM6cQ827gD2OjFQaTP
Behavioral task
behavioral1
Sample
28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/HWSignature.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/HWSignature.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SetupLib.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SetupLib.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/SogouPY.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/SogouPY.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/SogouPY64.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/SogouPY64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/SogouTSF.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/SogouTSF.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/SogouTSF64.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/SogouTSF64.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$SYSDIR/SogouPY.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$SYSDIR/SogouPY.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
$SYSDIR/SogouPY.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
$SYSDIR/SogouPY.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
$SYSDIR/SogouTSF.dll
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
$SYSDIR/SogouTSF.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
$_13_/HWSignature.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$_13_/HWSignature.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
7.8.0.7088/HWSignature.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
7.8.0.7088/HWSignature.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
7.8.0.7088/SogouPY.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
7.8.0.7088/SogouPY.dll
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118
-
Size
6.5MB
-
MD5
28edcb1ff25cd616bc9709b9dded1261
-
SHA1
d127c38e5ba60af11f55ea919caded6f65b788c7
-
SHA256
15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583
-
SHA512
3a0f7b5242bda03ec1bce572dfeb5a59a5c3aca103b04822d5eee64c63ae7bd4809ce51c190d4f5f0a12c4cb5c94e2d607ee4c5ba13093d16829fbf2e310449f
-
SSDEEP
98304:3//78eyjX2D3uw0axTiJ13y3AB2YfvLSioCsjNutnQBlYjEFy+u27gD2DyjU/YlL:vDGGLuw+v3JXZsjM6cQ827gD2OjFQaTP
Score7/10 -
-
-
Target
$PLUGINSDIR/HWSignature.dll
-
Size
78KB
-
MD5
87c80914dfc65df16f5ff36040666da3
-
SHA1
06aefe9570ef484a322c53297152f1ea50746878
-
SHA256
db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
-
SHA512
bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
-
SSDEEP
1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
-
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
15KB
-
MD5
6e663f1a0de94bc05d64d020da5d6f36
-
SHA1
c5abb0033776d6ab1f07e5b3568f7d64f90e5b04
-
SHA256
458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4
-
SHA512
2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5
-
SSDEEP
192:VsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mj8ozxGUWumle:VsUHd9GN2d2iwl0impATIPdAj8Ov6
Score3/10 -
-
-
Target
$PLUGINSDIR/SetupLib.dll
-
Size
2.4MB
-
MD5
129db08e936fd574643aea1bb88d1459
-
SHA1
147391794348b4e78c6240a7b550e01e0ae1d0fb
-
SHA256
ae9897c5aa08185050742ba4b982732d6b4e71565af2f94622e9bb8998f69dbb
-
SHA512
b814619f93668aac550d169bcff2b40cef39d07cb3d32d2454b3233fc459bd4ac87bf58f6d009616abb4f863c3d423f2f80e4803abc1ee064660b779ddf5472b
-
SSDEEP
24576:xXSULtoXic6SrKO8yzZqL0IiurkhER/QWcihDHl3lBkqRm5cQtMOt2uzsSylJYxV:xunhWcE3lEyc8LKLMREgWE8T9T9AF8p
Score3/10 -
-
-
Target
$PLUGINSDIR/SogouPY.ime
-
Size
4.9MB
-
MD5
67878eda87845d76dc5cf786568c3b5a
-
SHA1
1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
-
SHA256
29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
-
SHA512
53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
-
SSDEEP
49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
Score1/10 -
-
-
Target
$PLUGINSDIR/SogouPY64.ime
-
Size
8.3MB
-
MD5
d6bb082f1fd6edcd000e75d3822adbc8
-
SHA1
04783fa76820795009ce0c2ba176e2996b9b4acc
-
SHA256
4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
-
SHA512
4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
-
SSDEEP
49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
Score1/10 -
-
-
Target
$PLUGINSDIR/SogouTSF.ime
-
Size
1.1MB
-
MD5
b6a3aa486dd89f66d2811144d4e089e2
-
SHA1
931b3a5beb0ff1f1bd4a7dce4264a28e71aa3fc3
-
SHA256
500d36c3c9e11e246fd9f1e616f806a833e02ff9283152d3a94649ba08e4a602
-
SHA512
a759445c5a7b31574046382f3ecdb2c4a5b5d67f989cfe8bc91683161cd265e3c91c4b157ae63e06388ca903b404e35d068bc80b4b4157e01cfc5f05540614d1
-
SSDEEP
24576:IXULxRXSnM/6f/M2dx5N5cxnC279V+jTi6yTxcjGHX6RF:GMi/B6C279ylyThKRF
Score1/10 -
-
-
Target
$PLUGINSDIR/SogouTSF64.ime
-
Size
1.8MB
-
MD5
9781b5a306c996fe6408686b167c6750
-
SHA1
446c816ca849bd023d111acdd5cda94b7dd47099
-
SHA256
894efa9aa999124ab5bdc3e04aab2ac31cb02258c6a814e4c758796c1ce1daf5
-
SHA512
bd8c55ec6cf516404a19a9bd7a6ba787fb298a39cb474322c54fa839821bbc11f96fde19f5e76c4b5042e536ecfc79386ec446356f8da0fa920b4e5f3a9b7bca
-
SSDEEP
24576:oDBeZWKf0RfvAHIhMGas/wQ1d4DwE7QEOvJ1NZV5TWcj8c1es/+NrWQzI:oVeZWnACMGawdd3TEcYiUrWX
Score7/10-
Registers COM server for autorun
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
b9f430f71c7144d8ff4ab94be2785aa6
-
SHA1
c5c1e153caff7ad1d221a9acc8bbb831f05ccb05
-
SHA256
b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655
-
SHA512
c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099
-
SSDEEP
192:hClej3uzvJwqJMQKN4GbeWZksMI4ETWcEbcBZ8ep2Kra7yOG:hCm2HgN4GbeWmbI4Eybogia7yO
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
7823fc560926dcd8741de6f0b900083f
-
SHA1
93dc0a704bc0b8f90668548e36daf459be0ae10a
-
SHA256
ca869d6c6752aa4a8a6c874a694b543442992d7e854d0c48a1b60bca01a8c8c6
-
SHA512
c79509cd306638ea9badec64ed9f7d0690e46fcab7ac77f25134065b628e76d2812f2d874ea2cc4283685c567b613a39d27b9fc4a6de2d4b9d30131f3161c4e9
-
SSDEEP
192:SzQhZDqlJcKISw99ioU3MSfwLF/+nhHUVsdz:SzoZDGKYw9goWyFGBU4z
Score3/10 -
-
-
Target
$SYSDIR/SogouPY.ime
-
Size
8.3MB
-
MD5
d6bb082f1fd6edcd000e75d3822adbc8
-
SHA1
04783fa76820795009ce0c2ba176e2996b9b4acc
-
SHA256
4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
-
SHA512
4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
-
SSDEEP
49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
Score1/10 -
-
-
Target
$SYSDIR/SogouPY.ime~
-
Size
8.3MB
-
MD5
d6bb082f1fd6edcd000e75d3822adbc8
-
SHA1
04783fa76820795009ce0c2ba176e2996b9b4acc
-
SHA256
4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
-
SHA512
4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
-
SSDEEP
49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
Score1/10 -
-
-
Target
$SYSDIR/SogouTSF.ime
-
Size
1.1MB
-
MD5
b6a3aa486dd89f66d2811144d4e089e2
-
SHA1
931b3a5beb0ff1f1bd4a7dce4264a28e71aa3fc3
-
SHA256
500d36c3c9e11e246fd9f1e616f806a833e02ff9283152d3a94649ba08e4a602
-
SHA512
a759445c5a7b31574046382f3ecdb2c4a5b5d67f989cfe8bc91683161cd265e3c91c4b157ae63e06388ca903b404e35d068bc80b4b4157e01cfc5f05540614d1
-
SSDEEP
24576:IXULxRXSnM/6f/M2dx5N5cxnC279V+jTi6yTxcjGHX6RF:GMi/B6C279ylyThKRF
Score1/10 -
-
-
Target
$_13_/HWSignature.dll
-
Size
78KB
-
MD5
87c80914dfc65df16f5ff36040666da3
-
SHA1
06aefe9570ef484a322c53297152f1ea50746878
-
SHA256
db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
-
SHA512
bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
-
SSDEEP
1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
-
-
Target
7.8.0.7088/HWSignature.dll
-
Size
78KB
-
MD5
87c80914dfc65df16f5ff36040666da3
-
SHA1
06aefe9570ef484a322c53297152f1ea50746878
-
SHA256
db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
-
SHA512
bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
-
SSDEEP
1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
-
-
Target
7.8.0.7088/SogouPY.ime
-
Size
4.9MB
-
MD5
67878eda87845d76dc5cf786568c3b5a
-
SHA1
1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
-
SHA256
29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
-
SHA512
53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
-
SSDEEP
49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
Score1/10 -