Overview

overview

7

Static

static

7

7de727e1b0...18.exe

windows7-x64

7

7de727e1b0...18.exe

windows10-2004-x64

7

$PLUGINSDI...ff.dll

windows7-x64

3

$PLUGINSDI...ff.dll

windows10-2004-x64

3

$PLUGINSDI...lp.dll

windows7-x64

1

$PLUGINSDI...lp.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/hosts.exe

windows7-x64

7

$PLUGINSDIR/hosts.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows7-x64

7

$PLUGINSDI...ON.dll

windows10-2004-x64

7

DownLite.exe

windows7-x64

3

DownLite.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7de727e1b00f1952167048956903cc13_JaffaCakes118

  • Size

    5.8MB

  • Sample

    240528-wtqx2aef4s

  • MD5

    7de727e1b00f1952167048956903cc13

  • SHA1

    35bfc1bebd162153f6bc70791761d05afaa7d1fb

  • SHA256

    11ea964a30ea62a4bd2d0253ba3e8ffa53716de4534af58006339a7505601ae3

  • SHA512

    a9f34230b406b5af6498dffad1c95bc74d74040b40954720c05f359fc037d6703ed0dab67d87abc9eccf103ff58398cc1b2505e3c27848e6b0907a8f27a89747

  • SSDEEP

    98304:r1k8VO82XH5F1uftklJnHm6tVuDBv8tuIU5lccMTLVtBkIb7FDoZxhwJVDDMYMqQ:52XH8WHm6TuZ8tIDkxDpDXJmYMSCvbNh

Score
7/10
adwarediscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      7de727e1b00f1952167048956903cc13_JaffaCakes118

    • Size

      5.8MB

    • MD5

      7de727e1b00f1952167048956903cc13

    • SHA1

      35bfc1bebd162153f6bc70791761d05afaa7d1fb

    • SHA256

      11ea964a30ea62a4bd2d0253ba3e8ffa53716de4534af58006339a7505601ae3

    • SHA512

      a9f34230b406b5af6498dffad1c95bc74d74040b40954720c05f359fc037d6703ed0dab67d87abc9eccf103ff58398cc1b2505e3c27848e6b0907a8f27a89747

    • SSDEEP

      98304:r1k8VO82XH5F1uftklJnHm6tVuDBv8tuIU5lccMTLVtBkIb7FDoZxhwJVDDMYMqQ:52XH8WHm6TuZ8tIDkxDpDXJmYMSCvbNh

    Score
    7/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InstallerStuff.dll

    • Size

      115KB

    • MD5

      b506d349c4089079ab758ec5dfe2f512

    • SHA1

      3584cbbd56291738cf991845b893f985ab57ddd8

    • SHA256

      98cc6a88f1e05d41946e26c84bc75d3be32d4706783d23ee9a66cb563b5b785f

    • SHA512

      8f2841387f8e2990841c594228294eab16fd637dc72493e903c37a4575a60041aa2c3cb42b6b75db31a0c270fa71a0029bf8ce0629374972ba59fd7ac485a530

    • SSDEEP

      1536:aF/lMOy6cWef0K9CWGHyAkeW2Km+odcI9sWjcdQlBDe4p4iq5:+lMnTIpSAkeum+oe4BDe4p4ii

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/OCSetupHlp.dll

    • Size

      848KB

    • MD5

      9e4e850e12f2f4f869b2491dbbb17ceb

    • SHA1

      bd89581a89604b601c817ea680c2a224b46737f8

    • SHA256

      4d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6

    • SHA512

      9285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5

    • SSDEEP

      12288:w3RHConJZh6lVfdxrHtgFl2nMLlKT2OIPL8mKqSTSTpz4cB8:wkuMV1xrHaF8nMI2RPL8STpz4cB8

    Score
    1/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/hosts.exe

    • Size

      3.6MB

    • MD5

      359aa7efe76799ca9618a123c6326220

    • SHA1

      9dc371a888cf55f14a16ae823f743aee13c92bb5

    • SHA256

      db565b3a99dc62cc00641f677767ff27414cce5aa9ea944ed2ad41738b70e881

    • SHA512

      5ccb2b952386eadde3bde6ec89d5de01bb8b2b285d05d697719e32aebe1ac3d529747096b61c8ea15dde49db3c3dd7ea893c9a5e018319317ac899fa02a0bcd9

    • SSDEEP

      98304:6fIUL/jkm6ns3yGl1uuchFXRczPLIf2kIkK/8/TtjZsNEn:6tkm6s331uZZgpsM8Ps+

    Score
    7/10
    adwarediscoverypersistencespywarestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      14KB

    • MD5

      21010df9bc37daffcc0b5ae190381d85

    • SHA1

      a8ba022aafc1233894db29e40e569dfc8b280eb9

    • SHA256

      0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

    • SHA512

      95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

    • SSDEEP

      192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/WrapperUtils.dll

    • Size

      69KB

    • MD5

      2cb7f556341e254d282e7ec24a2c6164

    • SHA1

      87053c1dae3d1c8f2a6b5909b30ffeb8ef085b8f

    • SHA256

      def2632242ea5a7b30fd2808545ed81b1545aca18a0a517553db4f2dd1442d0c

    • SHA512

      79cb47e48c09f39958ff944c64aad2a3ef5cdb02975b68b9dcb85712e1a24baf48f856a8859efe77b66c10e487535496c4618482e864819104fda86249b29ce3

    • SSDEEP

      1536:hzbHgcmRxQxNjyVlrdV+FcaHC00tsWjcdcTdDu:TKhUvCscTdy

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/nsJSON.dll

    • Size

      6KB

    • MD5

      292aa9f95a7f081625056c497078159a

    • SHA1

      72076f3eb146ab7ea2b3dd0ef6a63c06f86d64f1

    • SHA256

      18f2b2f20c65a022a1c8aaf776b4c9be6c193b73c2079d9d65d56b802fcadfb5

    • SHA512

      87f83c3bbcfedd98364b5d0209f912e66c72d43eb887438ad9735c078e6d1f6ea12566a75f0b652602bbd9f0608ce7148dc1703821f2ab6b366f061b8a58d910

    • SSDEEP

      96:u2r8Z0x0OOG+2tOgdC+qzf+Sdv9wMxOHKCt6qZZLAL5EICN9r7HcnrDn:uHI+2e9zf++viMot6qZFYEIC7jcrL

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19behavioral20

    • Target

      DownLite.exe

    • Size

      2.1MB

    • MD5

      84d44cc04348df5226b733eba1b64eb6

    • SHA1

      3cc6d1a7aa6dcccf665c0c777af596d551fd953a

    • SHA256

      7126b3a28108726ee7d07024bce3611ed2d68f7fe75494124a04b9314488e605

    • SHA512

      40f11d74b158188b5d948d014ee82d70bd1b4a78710d7e596f961dd13fe212e6435ce2069ff4f483be3d8d23f8bf4fe478264b1c90f840660fcf4f7e0ded24b5

    • SSDEEP

      49152:0gSxAEDE727h0VKMPh3UWUZQLamNg5/U6l:Q82zMPh3bUqamWc6l

    Score
    3/10
    behavioral21behavioral22

MITRE ATT&CK Enterprise v15

Tasks