General

  • Target

    7199ac1b490ee536471c6c613fd9a170_JaffaCakes118

  • Size

    23.2MB

  • Sample

    240525-l4t3bsdf23

  • MD5

    7199ac1b490ee536471c6c613fd9a170

  • SHA1

    7004cff9c2143ad1af170adbd43f5977b8c4872a

  • SHA256

    a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649

  • SHA512

    4ebc3fd9648f91acbec0272d9cdb393b6d988c4441ebb60a0d9b7430b268f826f730ed1e0094b28dc68eeec56a8570c64ab8fbc40485fd50e476f73e22fb9b18

  • SSDEEP

    393216:9rX2hFm5Aes/9wDDyMTtOSufUD+Lk0QRQAm5EUymJONvTo3ofrzRUt3f9SNu8q8d:9b2EAwjtOjfM0QHmNXi8YTzRfNxTd

Malware Config

Targets

    • Target

      7199ac1b490ee536471c6c613fd9a170_JaffaCakes118

    • Size

      23.2MB

    • MD5

      7199ac1b490ee536471c6c613fd9a170

    • SHA1

      7004cff9c2143ad1af170adbd43f5977b8c4872a

    • SHA256

      a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649

    • SHA512

      4ebc3fd9648f91acbec0272d9cdb393b6d988c4441ebb60a0d9b7430b268f826f730ed1e0094b28dc68eeec56a8570c64ab8fbc40485fd50e476f73e22fb9b18

    • SSDEEP

      393216:9rX2hFm5Aes/9wDDyMTtOSufUD+Lk0QRQAm5EUymJONvTo3ofrzRUt3f9SNu8q8d:9b2EAwjtOjfM0QHmNXi8YTzRfNxTd

    Score
    7/10
    • Loads dropped DLL

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      20f3184efe7edddfef3325efc25d12a5

    • SHA1

      8db4c500d73f9525a7e9834df6caea2e70189939

    • SHA256

      0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

    • SHA512

      433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

    • SSDEEP

      192:v4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjWK72dwF7dBOne:wn3T5KdHCMRD/R1cOnrjW+BO

    Score
    3/10
    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    • Target

      $PLUGINSDIR/advsplash.dll

    • Size

      5KB

    • MD5

      669030d7919ae29999a2fd89aa427202

    • SHA1

      870bcb7e87bbf423abcbc1c5be80f7e63720a6d8

    • SHA256

      e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82

    • SHA512

      1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f

    • SSDEEP

      96:yqNXqwK188CgAtXvZBkjDf0yf9ysrtWp/wol:yAqrg1XvZB6kYtWp/

    Score
    3/10
    • Target

      PBWS32.DLL

    • Size

      38KB

    • MD5

      410d09e8cd553a560386c5a76f265cf5

    • SHA1

      30488587ce89e56f21ea9da7d3b172d93decae0f

    • SHA256

      8e55f3ed041daf39b531b20f4607111f2175dea1ddcbb0645b07c5fc808ed240

    • SHA512

      029c06457ef5b41f75dd7640e8d8c9eb663b9e190d977e9dbccfc8ff5181dc0b9d39cf4d72b4defd6542f0c0890e775f2d4cf974a6074b5f5009d5e29729f3ba

    • SSDEEP

      768:pngliMfJPJ3qSGA+LPBVAx8Lb2AUCTMz2a7easJ:vm3hG5LPB+EU/zfyaw

    Score
    1/10
    • Target

      baro.exe

    • Size

      6.9MB

    • MD5

      0a6375f253d7e944ca6e53587a4d21cc

    • SHA1

      ae8e1235e5a79a62b177c86cd27ac8eceb8701c6

    • SHA256

      35d9ef3efdaf11c4f8ce5cf286ba1bb9bddf6271a14c9e36670602558ee00f10

    • SHA512

      d10dd2e2333ee720b7a91c9f2afc3a672125e59a1f45b810c216bfd78d98d33b800f1f61e99b0e0b248c3711a8a2e6fe3eea909ef3f540ac237108bc675ed6ba

    • SSDEEP

      196608:MtNCAA7BwL0wSxQx7uNlxowB19vwKVaRr26qv1BNVlZVbmb/aE:2pTkdwKVaRr26qv1BNVlZVbm2E

    Score
    1/10
    • Target

      dll/FreeImage.dll

    • Size

      3.2MB

    • MD5

      2513b9e999605cf8c42a8aa96837feae

    • SHA1

      76dde6500a044ba14547a648939ac11b1eaecc73

    • SHA256

      242d585b09c90708e5d626c01cfe0e474a2dec53b80e8d7aaa8a5a6b0b9f7323

    • SHA512

      0d876cb2ea35dc1a2c17adfe592bc2bb6e4075d3d86c39e3b1c0803e486fb5a90f9720c8565d936adff9b2f8bacf08276a9fe0054a1d673a62fb2be6774ae7e6

    • SSDEEP

      24576:71sXq+eR0/+qT8tLVMN8UasVK0dRk/IwBO24GXrkL84hDvJ4/RCZyCVf4Bxky1Jz:aBe8PAU7SEyhIGbIeT7SwF

    Score
    3/10
    • Target

      dll/Interop.WIA.dll

    • Size

      44KB

    • MD5

      858dd3d914c467b8c2326f015d927aca

    • SHA1

      48c836f62bcc9ec1c7dd7983c5bce9bec49c3db7

    • SHA256

      a9f47fa2b08f86fc7815c62321f71d727ff052288d01af09765ba5dd87f06ce0

    • SHA512

      cdaa609b8ae775a2c3b68415d368c51ef8cc67d9ed63e88a8613c809b4af8ac7975099f3f3941616b154065ecea60010ff90fc3cb92879711178abce0a4affc6

    • SSDEEP

      768:mvlrTN8xKiauFV1A1ZFWOmsQJ8m+N2wVZMc3jN2:Mlrp8NHmiBsQJ8m+MrAjE

    Score
    1/10
    • Target

      dll/MarkupConverter.dll

    • Size

      79KB

    • MD5

      e42dead11301b7bdd39ffaa08942e8ff

    • SHA1

      986fe2d1bf0e6b69a1966e8657648f41fc24dff3

    • SHA256

      1f269d459ad472274bc9c83762027fe77444f1d429f914adade77ffc869d3f47

    • SHA512

      eaaae18441ae8b25bb6793af74e1febbbb8b0e398c724106652544f4ab28b3602c58d6a584ebc396ccbcc7d43f259d8ac47146aa18b1046f8e0d365234c23e2e

    • SSDEEP

      1536:AAK778X2zLoMa6Un8y7b3hmkcecwNjpW5loU5TJYVEnofviwuPnNrXLP2zrmH1nU:Q778XULoMa69Yb34lecQwr4rmH1nG2nU

    Score
    1/10
    • Target

      dll/PdfSharp.dll

    • Size

      568KB

    • MD5

      f9a4afed4a99e87450a359c3988c43d0

    • SHA1

      2a9082ca8b5276cb080c566277370680d48f78e7

    • SHA256

      6175d361837348f401db75f7c3f9ce541dd84ae015741feef8cc921398953176

    • SHA512

      b74b0a3149594fefb5e8972eb9baa3f953962fe9179de7db77d9915e9d7710612fc58b74d2296c64c9ad3033c7cc45e76d59fe32471a8ae0b4b309cd0017a600

    • SSDEEP

      12288:8GBiN8GPX1MfQlhbeyIVr1KWqVw/epCEbmgldA:851cQlhbp+D/epCEbmglG

    Score
    1/10
    • Target

      dll/RegAsm.exe

    • Size

      52KB

    • MD5

      4b63f5e28d8e2ed769cd900bf0709c22

    • SHA1

      8cdb6b0f735adf9ccf5cabd96df56edff72b287d

    • SHA256

      9e285994ac0c76f4b8b85878e9288972c512661c3ca089c23ec6713740510a36

    • SHA512

      cca29d8ffcb2829c23746b03d381c6cde5d44ceb96c99828ef73ec4f420ab239a641e7c3dd496ac75e65cb30b391ffd4a410f361e9b0d13b7715b48283a7bc22

    • SSDEEP

      768:L4P2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2ZWFRJS8j:/Jv46yoD2BTNz1+M9GLfew8j

    Score
    1/10
    • Target

      dll/SDD_TWAIN_SCANNER.dll

    • Size

      28KB

    • MD5

      71f87c5507828fb30aa7928659936405

    • SHA1

      a0ccde3b03b87bdb6f0e02a4fde013a79962a177

    • SHA256

      06421ed3b1060772dadb09cb4ac5bdff2d62c879c3738c8807fc7548ad3fbd69

    • SHA512

      078a28d36d48a0363134b9999f035efa4093d6a95b8459e43619dfd38d48bb475c468ddaaeddd03574ad91cb841ff9c27b7d9f3df985997a06af74424fa6411e

    • SSDEEP

      384:VpMi7JRs0Z7ICYutP8XMZu1piGFdfxHj1vITVm2Mil6InzRM9xhJrFcDgPoUxQfD:zICYrXeUoGTxD1vIwfCABPoUxOdH

    Score
    1/10
    • Target

      dll/Saraff.Twain.dll

    • Size

      52KB

    • MD5

      dfd91064c061ee5a3245c936daee1d6a

    • SHA1

      29db79f7b45611d769467f4e063ef00feebe5073

    • SHA256

      2a92904383d482d5073fcbd9c2cbdc115c6fabd171a8173991c1992bdc01533a

    • SHA512

      e121b6b0320a15499d0befef6adf0ce678562cf3185451393f563bf9335f39ac222c1490d6057db1f83f9cca63cd8e7485e245a05bdfcb5235d570593a517448

    • SSDEEP

      1536:7SoLvyDjdUdQHUGSar8BrxvRC5RIt7Sz19:GUvyusBSRrx85g7Sz19

    Score
    1/10
    • Target

      dll/System.Drawing.dll

    • Size

      616KB

    • MD5

      3716fb11c20e313d2deb35e9a73a05f6

    • SHA1

      a26cecb78abc8f45913968bcd864a18f26ff165f

    • SHA256

      7b92496ac930d5f891654f3b4d3ecfa2751dbc86df314c1a141801d1ebfe8643

    • SHA512

      f0c7fd525e8a4d3642d9ff7b88b6081bc19126a92b3497de1ea1677416dbaeaa5b8e0be82d8344f0ac253f86d01ce66e10472b5ad654772c896871243ab503c7

    • SSDEEP

      6144:y/EoafvVBEQUIHx0lqYuRk5ydBZCpPSUC0ixkapt6i9SiSFqBywtlnISJHDEnChp:wafvVBDIQ6Knt6iHyqBPV5Rr9

    Score
    1/10
    • Target

      dll/UzakYardim.exe

    • Size

      740KB

    • MD5

      10a524d7ac94678ae286b065421647db

    • SHA1

      b538e3f113817c8237419310ef47817d1d961fa9

    • SHA256

      55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4

    • SHA512

      928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b

    • SSDEEP

      12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy

    Score
    10/10
    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Target

      dll/WinSCP.com

    • Size

      277KB

    • MD5

      50c182293fef31782db383b5f5fb5a3f

    • SHA1

      f884abacee9918bd3d454e531638aa16219d3f2b

    • SHA256

      24e98f04948e730121af8c6f186b8b288a66bfdf88dcf4d11b7ef2878463bd89

    • SHA512

      0399940f9661cbc156395700a0c3a5e6d69d02f7cb9bc43c7437cdcc4106e4e3a813ebd615e016e842b0ed93b14435f9134cd0d61a985b840fe922db65e6ba62

    • SSDEEP

      6144:skdBy6tHmG676IS8i5cSXX6a8sg4iAA+KVI:By6tHe76IS8i5LXviAAje

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks

static1

ammyyadmin
Score
10/10

behavioral1

Score
7/10

behavioral2

Score
7/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

flawedammyytrojan
Score
10/10

behavioral30

flawedammyytrojan
Score
10/10

behavioral31

Score
6/10

behavioral32

Score
7/10