Overview

overview

10

Static

static

7

cfsamdsfzr...��.exe

windows7-x64

10

cfsamdsfzr...��.exe

windows10-2004-x64

cfsamdsfzr...yg.dll

windows7-x64

10

cfsamdsfzr...yg.dll

windows10-2004-x64

10

cfsamdsfzr...��.exe

windows7-x64

7

cfsamdsfzr...��.exe

windows10-2004-x64

7

cfsamdsfzr...��.bat

windows7-x64

1

cfsamdsfzr...��.bat

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    672fe68501129c0ba60eec0d6bcddfc0_JaffaCakes118

  • Size

    12.5MB

  • Sample

    240522-n488csff98

  • MD5

    672fe68501129c0ba60eec0d6bcddfc0

  • SHA1

    5252d5c4f9c5d181d4f5bffa242030c1cbac8038

  • SHA256

    d0da063e0dad6f9b92888f7aaa95887474fedbb786a2c9dff7d72fc81caf18ff

  • SHA512

    c393d6b51e23f9bb8177764f23cdd22c2d31292a0de2cd22de75d45078adaac29ef8f803c80cace33a330bb99f1aa8ea564e307cf24052abe3bfe2b5533e0304

  • SSDEEP

    393216:pIeJEtWwu++g5R6P2I0Plox4VPiFTKk9BB:pIntHuIRKou4VPidZ9

Score
10/10
blackmoonramnitbankerspywarestealertrojanupxvmprotectworm

Malware Config

Targets

    • Target

      cfsamdsfzrej_gr/LOL意哥破解版/LOL意哥全能辅助.exe

    • Size

      11.4MB

    • MD5

      023a521e6cd4e539da30086da993176c

    • SHA1

      1f33591e1fe3b5e5daabf903ab44ba52b5f302a1

    • SHA256

      fc1125bc588065dfeb94e20bf41ff25db7bd812c8a1b964087f239489ca976f4

    • SHA512

      1e2b2a31862587f1ca94149ccd9466fe04bd2b06344866ea9b1c1068a38dc7daec0c668d0558abbffc955d8ab8af5b242f81073fd3508d07249006bb3d81fba9

    • SSDEEP

      196608:l7vzAIaW9+1lFgJklVv5CjCDFDADZTIj3FFMAIw+w9GqjYoj0yoXe3:lbzAtWWlFO2AjCD1ADZTIj3IAIw+w9GY

    Score
    10/10
    blackmoonbankertrojanupxvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

    • Target

      cfsamdsfzrej_gr/LOL意哥破解版/lolyg.dll

    • Size

      369KB

    • MD5

      56c93154ca93d39732213aec4a808007

    • SHA1

      18b2ceb3655a3da841cc0610ac685bd34a777686

    • SHA256

      a25c8b9fb0b00a3a16394b40eea0d22ba6aaf9718c7d489e55c9e18d0dd459e0

    • SHA512

      86f963568a6831618144d158d63c5710ad81f0f18b5daea7de07020c06b5793909764919d289855dc720f3701a4e911116192d605086261bf1e94714fcaf1908

    • SSDEEP

      6144:B34tMU0GBeE8HmknK2h01GRny0zSGKO8MRWt816+pK:Z4t4/JHmd001GRn01BK13K

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      cfsamdsfzrej_gr/LOL意哥破解版/娇滴滴破解.exe

    • Size

      1.2MB

    • MD5

      202efeb10f273ed71db018dd3b45c098

    • SHA1

      b7c24e3e623c8d2f620ce190f87317efb58934a5

    • SHA256

      03622c533b1c4e7c447eb8e5f3df62fe3dd22b6d8c9f674ff6ae3e145924b8b8

    • SHA512

      9afaa6985ec3c422755e6403c353374a988b7fa058af68a27b94ae20030383f625d1ab4f2309eef517e362b2a937737aaca9740ee67600cd0e05fa42de8a9b02

    • SSDEEP

      24576:HGqCMfDstdS2Tk+YPgsxfbP1mcm6fIyzUlr:HKMyS2JcgsBJmcOyzA

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral5behavioral6

    • Target

      cfsamdsfzrej_gr/LOL意哥破解版/插件注册失败打开.bat

    • Size

      28B

    • MD5

      f5dd85d817d4b023053c3999d7095dbb

    • SHA1

      83d10b603a71b45e2c06e168d4d07259ad15d009

    • SHA256

      7fec325d3f869a0b0214139a87b1dde716d4931923916e6fe58eefd7b6cfdea0

    • SHA512

      8f69d8f854e0e2494ad6314925ac515e57d98dc6dc20f7960dfd8efe62b14ed4904c086207203d278ee5b82bd328b2643e9e27e794905cdd30b9296d4cbb394d

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks