Overview
overview
10Static
static
107199ac1b49...18.exe
windows7-x64
77199ac1b49...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3PBWS32.dll
windows7-x64
1PBWS32.dll
windows10-2004-x64
1baro.exe
windows7-x64
1baro.exe
windows10-2004-x64
1dll/FreeImage.dll
windows7-x64
3dll/FreeImage.dll
windows10-2004-x64
3dll/Interop.WIA.dll
windows7-x64
1dll/Interop.WIA.dll
windows10-2004-x64
1dll/Markup...er.dll
windows7-x64
1dll/Markup...er.dll
windows10-2004-x64
1dll/PdfSharp.dll
windows7-x64
1dll/PdfSharp.dll
windows10-2004-x64
1dll/RegAsm.exe
windows7-x64
1dll/RegAsm.exe
windows10-2004-x64
1dll/SDD_TW...ER.dll
windows7-x64
1dll/SDD_TW...ER.dll
windows10-2004-x64
1dll/Saraff.Twain.dll
windows7-x64
1dll/Saraff.Twain.dll
windows10-2004-x64
1dll/System...ng.dll
windows7-x64
1dll/System...ng.dll
windows10-2004-x64
1dll/UzakYardim.exe
windows7-x64
10dll/UzakYardim.exe
windows10-2004-x64
10dll/WinSCP.exe
windows7-x64
6dll/WinSCP.exe
windows10-2004-x64
7General
-
Target
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118
-
Size
23.2MB
-
Sample
240525-l4t3bsdf23
-
MD5
7199ac1b490ee536471c6c613fd9a170
-
SHA1
7004cff9c2143ad1af170adbd43f5977b8c4872a
-
SHA256
a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649
-
SHA512
4ebc3fd9648f91acbec0272d9cdb393b6d988c4441ebb60a0d9b7430b268f826f730ed1e0094b28dc68eeec56a8570c64ab8fbc40485fd50e476f73e22fb9b18
-
SSDEEP
393216:9rX2hFm5Aes/9wDDyMTtOSufUD+Lk0QRQAm5EUymJONvTo3ofrzRUt3f9SNu8q8d:9b2EAwjtOjfM0QHmNXi8YTzRfNxTd
Behavioral task
behavioral1
Sample
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/advsplash.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
PBWS32.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
PBWS32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
baro.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
baro.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
dll/FreeImage.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
dll/FreeImage.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
dll/Interop.WIA.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
dll/Interop.WIA.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
dll/MarkupConverter.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
dll/MarkupConverter.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
dll/PdfSharp.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
dll/PdfSharp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
dll/RegAsm.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
dll/RegAsm.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
dll/SDD_TWAIN_SCANNER.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
dll/SDD_TWAIN_SCANNER.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
dll/Saraff.Twain.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
dll/Saraff.Twain.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
dll/System.Drawing.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
dll/System.Drawing.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
dll/UzakYardim.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
dll/UzakYardim.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
dll/WinSCP.exe
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
dll/WinSCP.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118
-
Size
23.2MB
-
MD5
7199ac1b490ee536471c6c613fd9a170
-
SHA1
7004cff9c2143ad1af170adbd43f5977b8c4872a
-
SHA256
a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649
-
SHA512
4ebc3fd9648f91acbec0272d9cdb393b6d988c4441ebb60a0d9b7430b268f826f730ed1e0094b28dc68eeec56a8570c64ab8fbc40485fd50e476f73e22fb9b18
-
SSDEEP
393216:9rX2hFm5Aes/9wDDyMTtOSufUD+Lk0QRQAm5EUymJONvTo3ofrzRUt3f9SNu8q8d:9b2EAwjtOjfM0QHmNXi8YTzRfNxTd
Score7/10-
Loads dropped DLL
-
-
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
20f3184efe7edddfef3325efc25d12a5
-
SHA1
8db4c500d73f9525a7e9834df6caea2e70189939
-
SHA256
0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a
-
SHA512
433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a
-
SSDEEP
192:v4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjWK72dwF7dBOne:wn3T5KdHCMRD/R1cOnrjW+BO
Score3/10 -
-
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
ea60c7bd5edd6048601729bd31362c16
-
SHA1
6e6919d969eb61a141595014395b6c3f44139073
-
SHA256
4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39
-
SHA512
f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993
-
SSDEEP
48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd
Score3/10 -
-
-
Target
$PLUGINSDIR/advsplash.dll
-
Size
5KB
-
MD5
669030d7919ae29999a2fd89aa427202
-
SHA1
870bcb7e87bbf423abcbc1c5be80f7e63720a6d8
-
SHA256
e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82
-
SHA512
1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f
-
SSDEEP
96:yqNXqwK188CgAtXvZBkjDf0yf9ysrtWp/wol:yAqrg1XvZB6kYtWp/
Score3/10 -
-
-
Target
PBWS32.DLL
-
Size
38KB
-
MD5
410d09e8cd553a560386c5a76f265cf5
-
SHA1
30488587ce89e56f21ea9da7d3b172d93decae0f
-
SHA256
8e55f3ed041daf39b531b20f4607111f2175dea1ddcbb0645b07c5fc808ed240
-
SHA512
029c06457ef5b41f75dd7640e8d8c9eb663b9e190d977e9dbccfc8ff5181dc0b9d39cf4d72b4defd6542f0c0890e775f2d4cf974a6074b5f5009d5e29729f3ba
-
SSDEEP
768:pngliMfJPJ3qSGA+LPBVAx8Lb2AUCTMz2a7easJ:vm3hG5LPB+EU/zfyaw
Score1/10 -
-
-
Target
baro.exe
-
Size
6.9MB
-
MD5
0a6375f253d7e944ca6e53587a4d21cc
-
SHA1
ae8e1235e5a79a62b177c86cd27ac8eceb8701c6
-
SHA256
35d9ef3efdaf11c4f8ce5cf286ba1bb9bddf6271a14c9e36670602558ee00f10
-
SHA512
d10dd2e2333ee720b7a91c9f2afc3a672125e59a1f45b810c216bfd78d98d33b800f1f61e99b0e0b248c3711a8a2e6fe3eea909ef3f540ac237108bc675ed6ba
-
SSDEEP
196608:MtNCAA7BwL0wSxQx7uNlxowB19vwKVaRr26qv1BNVlZVbmb/aE:2pTkdwKVaRr26qv1BNVlZVbm2E
Score1/10 -
-
-
Target
dll/FreeImage.dll
-
Size
3.2MB
-
MD5
2513b9e999605cf8c42a8aa96837feae
-
SHA1
76dde6500a044ba14547a648939ac11b1eaecc73
-
SHA256
242d585b09c90708e5d626c01cfe0e474a2dec53b80e8d7aaa8a5a6b0b9f7323
-
SHA512
0d876cb2ea35dc1a2c17adfe592bc2bb6e4075d3d86c39e3b1c0803e486fb5a90f9720c8565d936adff9b2f8bacf08276a9fe0054a1d673a62fb2be6774ae7e6
-
SSDEEP
24576:71sXq+eR0/+qT8tLVMN8UasVK0dRk/IwBO24GXrkL84hDvJ4/RCZyCVf4Bxky1Jz:aBe8PAU7SEyhIGbIeT7SwF
Score3/10 -
-
-
Target
dll/Interop.WIA.dll
-
Size
44KB
-
MD5
858dd3d914c467b8c2326f015d927aca
-
SHA1
48c836f62bcc9ec1c7dd7983c5bce9bec49c3db7
-
SHA256
a9f47fa2b08f86fc7815c62321f71d727ff052288d01af09765ba5dd87f06ce0
-
SHA512
cdaa609b8ae775a2c3b68415d368c51ef8cc67d9ed63e88a8613c809b4af8ac7975099f3f3941616b154065ecea60010ff90fc3cb92879711178abce0a4affc6
-
SSDEEP
768:mvlrTN8xKiauFV1A1ZFWOmsQJ8m+N2wVZMc3jN2:Mlrp8NHmiBsQJ8m+MrAjE
Score1/10 -
-
-
Target
dll/MarkupConverter.dll
-
Size
79KB
-
MD5
e42dead11301b7bdd39ffaa08942e8ff
-
SHA1
986fe2d1bf0e6b69a1966e8657648f41fc24dff3
-
SHA256
1f269d459ad472274bc9c83762027fe77444f1d429f914adade77ffc869d3f47
-
SHA512
eaaae18441ae8b25bb6793af74e1febbbb8b0e398c724106652544f4ab28b3602c58d6a584ebc396ccbcc7d43f259d8ac47146aa18b1046f8e0d365234c23e2e
-
SSDEEP
1536:AAK778X2zLoMa6Un8y7b3hmkcecwNjpW5loU5TJYVEnofviwuPnNrXLP2zrmH1nU:Q778XULoMa69Yb34lecQwr4rmH1nG2nU
Score1/10 -
-
-
Target
dll/PdfSharp.dll
-
Size
568KB
-
MD5
f9a4afed4a99e87450a359c3988c43d0
-
SHA1
2a9082ca8b5276cb080c566277370680d48f78e7
-
SHA256
6175d361837348f401db75f7c3f9ce541dd84ae015741feef8cc921398953176
-
SHA512
b74b0a3149594fefb5e8972eb9baa3f953962fe9179de7db77d9915e9d7710612fc58b74d2296c64c9ad3033c7cc45e76d59fe32471a8ae0b4b309cd0017a600
-
SSDEEP
12288:8GBiN8GPX1MfQlhbeyIVr1KWqVw/epCEbmgldA:851cQlhbp+D/epCEbmglG
Score1/10 -
-
-
Target
dll/RegAsm.exe
-
Size
52KB
-
MD5
4b63f5e28d8e2ed769cd900bf0709c22
-
SHA1
8cdb6b0f735adf9ccf5cabd96df56edff72b287d
-
SHA256
9e285994ac0c76f4b8b85878e9288972c512661c3ca089c23ec6713740510a36
-
SHA512
cca29d8ffcb2829c23746b03d381c6cde5d44ceb96c99828ef73ec4f420ab239a641e7c3dd496ac75e65cb30b391ffd4a410f361e9b0d13b7715b48283a7bc22
-
SSDEEP
768:L4P2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2ZWFRJS8j:/Jv46yoD2BTNz1+M9GLfew8j
Score1/10 -
-
-
Target
dll/SDD_TWAIN_SCANNER.dll
-
Size
28KB
-
MD5
71f87c5507828fb30aa7928659936405
-
SHA1
a0ccde3b03b87bdb6f0e02a4fde013a79962a177
-
SHA256
06421ed3b1060772dadb09cb4ac5bdff2d62c879c3738c8807fc7548ad3fbd69
-
SHA512
078a28d36d48a0363134b9999f035efa4093d6a95b8459e43619dfd38d48bb475c468ddaaeddd03574ad91cb841ff9c27b7d9f3df985997a06af74424fa6411e
-
SSDEEP
384:VpMi7JRs0Z7ICYutP8XMZu1piGFdfxHj1vITVm2Mil6InzRM9xhJrFcDgPoUxQfD:zICYrXeUoGTxD1vIwfCABPoUxOdH
Score1/10 -
-
-
Target
dll/Saraff.Twain.dll
-
Size
52KB
-
MD5
dfd91064c061ee5a3245c936daee1d6a
-
SHA1
29db79f7b45611d769467f4e063ef00feebe5073
-
SHA256
2a92904383d482d5073fcbd9c2cbdc115c6fabd171a8173991c1992bdc01533a
-
SHA512
e121b6b0320a15499d0befef6adf0ce678562cf3185451393f563bf9335f39ac222c1490d6057db1f83f9cca63cd8e7485e245a05bdfcb5235d570593a517448
-
SSDEEP
1536:7SoLvyDjdUdQHUGSar8BrxvRC5RIt7Sz19:GUvyusBSRrx85g7Sz19
Score1/10 -
-
-
Target
dll/System.Drawing.dll
-
Size
616KB
-
MD5
3716fb11c20e313d2deb35e9a73a05f6
-
SHA1
a26cecb78abc8f45913968bcd864a18f26ff165f
-
SHA256
7b92496ac930d5f891654f3b4d3ecfa2751dbc86df314c1a141801d1ebfe8643
-
SHA512
f0c7fd525e8a4d3642d9ff7b88b6081bc19126a92b3497de1ea1677416dbaeaa5b8e0be82d8344f0ac253f86d01ce66e10472b5ad654772c896871243ab503c7
-
SSDEEP
6144:y/EoafvVBEQUIHx0lqYuRk5ydBZCpPSUC0ixkapt6i9SiSFqBywtlnISJHDEnChp:wafvVBDIQ6Knt6iHyqBPV5Rr9
Score1/10 -
-
-
Target
dll/UzakYardim.exe
-
Size
740KB
-
MD5
10a524d7ac94678ae286b065421647db
-
SHA1
b538e3f113817c8237419310ef47817d1d961fa9
-
SHA256
55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
-
SHA512
928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
-
SSDEEP
12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy
Score10/10-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
-
-
Target
dll/WinSCP.com
-
Size
277KB
-
MD5
50c182293fef31782db383b5f5fb5a3f
-
SHA1
f884abacee9918bd3d454e531638aa16219d3f2b
-
SHA256
24e98f04948e730121af8c6f186b8b288a66bfdf88dcf4d11b7ef2878463bd89
-
SHA512
0399940f9661cbc156395700a0c3a5e6d69d02f7cb9bc43c7437cdcc4106e4e3a813ebd615e016e842b0ed93b14435f9134cd0d61a985b840fe922db65e6ba62
-
SSDEEP
6144:skdBy6tHmG676IS8i5cSXX6a8sg4iAA+KVI:By6tHe76IS8i5LXviAAje
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-