0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf

Sharing

Copy URL Twitter E-mail

General

Target
8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118
Size 13.9MB
Sample240601-p5e7cade87
SHA256 0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf
MD5 8a8322becd5a1eee98a776a6aa573f03
SHA1 e6a29ed2cfa0f20753a6c59aaccf2e4c76eaca76
SHA512 e04a1b4f969a41c45e54f6fdf8118597ede0bc910dced595b5f2ddcdce957b3dd225f0c629e7e5e3b70d66eb4d0e550edeaf1cf0836837fe21bde8577435cdd3
SSDEEP 196608:kewkER6VbBiYl/yWDocWTz+3OugWW45TUUA57nADSuPPnWkxhEjpW7QBA/HNwSna:HwvuiSEVzuP25szPPh3EjplaiW+zUa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118
- Size 13.9MB
- SHA256 0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf
- MD5 8a8322becd5a1eee98a776a6aa573f03
- SHA1 e6a29ed2cfa0f20753a6c59aaccf2e4c76eaca76
- SHA512 e04a1b4f969a41c45e54f6fdf8118597ede0bc910dced595b5f2ddcdce957b3dd225f0c629e7e5e3b70d66eb4d0e550edeaf1cf0836837fe21bde8577435cdd3
- SSDEEP 196608:kewkER6VbBiYl/yWDocWTz+3OugWW45TUUA57nADSuPPnWkxhEjpW7QBA/HNwSna:HwvuiSEVzuP25szPPh3EjplaiW+zUa
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit persistence upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallHelper.dll
- Size 320KB
- SHA256 3507d6cd8472340f8a8d6cfae84370fa2b9a42114488720a4958d5a7fde0d1bf
- MD5 4be1dc408cc08c562aa5d1dec0473d6a
- SHA1 19558333e4aa11afeb9ebefe86247aee38264190
- SHA512 1df0c384bfc70db083b1bae2d9ebd209c9e076e37bf47b33f1f277374ccbf29e04754388a7d5c0406237a7443567ec9cc274500e19f069a2d445f607751161bb
- SSDEEP 6144:F3jxPxKh/ICK7eprXNSVeGqjBcvw40frIcDxG2lKi:FTxPxKiMX+Utcvl0jIcDxG9i
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
- MD5 89351a0a6a89519c86c5531e20dab9ea
- SHA1 9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
- SHA512 13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08
- SSDEEP 384:/MnT0MKT/Xwr2izZQ86mpAT8F9lN8Ov0J:EQMKzwTFnVX8i0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/QQMusicResource.dll
- Size 711KB
- SHA256 b58885befc56dc4d91dd29c15e1dea36b58d9c42863a408bb3fe96a1af1151a8
- MD5 13c2a252683c75ed23910b89d4a669e5
- SHA1 ee53fe8cdd409fa78700bc03b350432c27bdc4d8
- SHA512 73723b50252cc0919c7b39dd33e385db6983e40d4273df6a5972889bfd7a93fab1fbd00ba1800f9ac5de480f4a19985995218c42b37808e133b88533840c9c36
- SSDEEP 3072:rayWt6oDjbhHbRsiww9E12U2jA9W/1ipKLe7FwLPZ2kx83w7ONllbDKH9bu2e3H9:kbts4k2LJ2y5s9DKHBsH9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PROGRAMFILES/Tencent/QZoneMusic/$_24_/QzoneMusic.dll
- Size 383KB
- SHA256 ea06d32ed8cf410337e1ad365beb828c96d7f9826cb4c3effc2f90fb08600aea
- MD5 5a086fd55948ae0aaec0c69df88b4880
- SHA1 48541cb68eb4387778fe7d23008a982f5879d0a2
- SHA512 636be5d2a52d9d3fd88ed034a3169a27f3f75ba59284e78abc84ca258438f7ec5fa7d865ef7298f4a72b96f3db0592e7a0b567191fa0fc9a588e2c5e013c1e4a
- SSDEEP 6144:BhMEktikTGmo68BcGzBZ70Qi9hDeEU50wDIV2CAcoQsCNGOgkAgh/v5XiWzNN:BuRiPcGH4Q4hDeUg8+WX
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  $PROGRAMFILES/Tencent/QZoneMusic/$_24_/QzoneMusic.exe
- Size 387KB
- SHA256 c66abcb5b82f212e73c73e594be93162f1c59816f43994f6912f2fb1c3165d26
- MD5 a38e547d5a7d8be5a0ca6da4e329e346
- SHA1 1e544b6e1a56b056738f8c7ed7de4212e7a4f110
- SHA512 d459224116bb604959afb06fe3264f3a3ce9a1eba0f137151a4d02e2e17210b1fd7c935615f0a411e0ddbcfef8ff9a19fa80741a8481ac7c94e2e2af3fe204f2
- SSDEEP 6144:u8Sg7IIQ8Emzfu45rPhoraMUa5bDfeii9jqPOzOrAIRIO:wg7xQpEfn5rPhDMUa5vfY9jDDO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $PROGRAMFILES/Tencent/QZoneMusic/$_24_/npQzoneMusic.dll
- Size 151KB
- SHA256 3bc2ac947b223e780aa24fbca81ddac6a787b8676467d7f262c119fdac9596a7
- MD5 0de6a20935af7f3d4d5b291f887dcbdb
- SHA1 c573828c85bfe571d84672fb985550ece1a5a92c
- SHA512 34d4833ef328fc882a0cf7ef60dcfe14d4361ce27812bbbfa26f9ea0abc3d5a17cbe42ab5dd7dfc7fa94fd351eaf94555ff0a2e5d63a61e13fdd27405573159c
- SSDEEP 3072:g7/7JDBWfQjJvXjp3upkHnjA9WNUYwTZ1nUoINDMOgunzHIVbDN:W7PWfQjJvTdujIl0QMOgu6P
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  $TEMP/QQPCDetector.exe
- Size 1.0MB
- SHA256 133f91e2862eaa771b3c9235ad96f14d8f1ccb087bb4e72d5e2ce000de2245fc
- MD5 1e28fd208a93540fac22e94f64dc8c15
- SHA1 63e7697bf0f3cc25e359ceaeeb63d40a4894f668
- SHA512 1c3499a91b51760c41ad99d5aecf67653c4ae965b50196376ff36fc0892d1613594449fa5821e19bc3dbc474ab2d2424e0b0eaf30c2aae9bc090009737552820
- SSDEEP 24576:mz8s9AlA9YVZqPurm8U2222222KZDibQCI6Vd2Qy68pCx2U5aaU:i9ApVSurm8oAbl8Qy1W22a
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  AutoPowerOff.exe
- Size 15KB
- SHA256 fdd0b58e89f5aed3188c363f0a727cd151dbf7f897a0afcdb73c7e6d16aa3cb4
- MD5 8c43695114fe3cfecca0c0ade87b94fc
- SHA1 38e5a9393f6dbe525af66614d3e8d7e28f8e43b3
- SHA512 f3e6e3c45e9e2f1c36e5b02ef8f6489e4ce9a893ff64cb9df1c9ad4455c810fc9aac248358ba67d17b36be81dd7fdbb7fb73985d0387e0f6a9033c1f524f3ba4
- SSDEEP 192:IA5qIaeuZzcq+twXE9Mt6dkqf5HSfpEnYe+PjPQu7qrPyIAm+vy6QEr9ZCspE+TE:Ioq44EtAE9i6ZHSGnYPLQjyIANweM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  CMInternet.dll
- Size 38KB
- SHA256 953358c5477adc69d51d1aac776de1d388b083284c6e0e6068b7751397585c0e
- MD5 97e19e423f2262dd9cbf8079ff7c7a1b
- SHA1 0a113fccd95c9f253917c1912546e513e44148a6
- SHA512 5977a67811be44dcef4edf2380581f586799cc340f942eb9c7a12a99055c141b10e10fa521eda1a6d5bc4cfda439e6c655a2ea32fcd8815adfaff362fd1ad63d
- SSDEEP 768:i/SZ2FpZsXdPQaz3ASDXeGCTMQK3hBOg80lpDr:38FbMPQaz3ASDXmTMQK3XOg80l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  Common.dll
- Size 1.9MB
- SHA256 ff8f33d0e6d7052976ea7e9d8402ff7316234a9330dde9ab074fe3da9ca9355a
- MD5 37d50e06c23dc128b7e7ef576bbc2fdf
- SHA1 507e673fb79ddc3002d485a79f9346e6a93f72dd
- SHA512 4e1aab496076f3df6cc76a0f3554d3ef5f89ae7660d8a6eb2dbdac80c9512373b3b1f840bd10edfbee0d8434e62dbd6c393b2740ca7d8983e7a343a10cb2f0ed
- SSDEEP 24576:UQlNxjTw4goSf6QIVssBIHa98R/Q/njhVUAmd+k4S4PSXESwSF5yD4G5sMhje1I:9NNzSfVViIHaCR/QPAAPFSZyMMhje1I
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  DataTransform.exe
- Size 86KB
- SHA256 a36576eaf516da5eb76b78e1ea57c71a01e864a2a4ecd446c4edbd609236147d
- MD5 b916970c686e9dccf08783411342a858
- SHA1 d4541192f158e328a1eca7ea839c13504ef3d1de
- SHA512 d34fee926e3a5d04a4cb6bea4cd7fef45d92161876bd3e9b293152a86c404205a810b4f208e6e94711e25df22c44d8e38d5c4e1295f9b069dccb9932c2ef7cbf
- SSDEEP 1536:5HmY2Lw4b9dqw95ejc9OzBlu+7Svjqi5PdK6bepVtZmaqQ5OWsysj:5GBDZfctAZA6beHOWNsj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  DataTransformEx.exe
- Size 63KB
- SHA256 bd1c8439220040ab0a1002d8774bd66394c83d7d5a6dda277dadd4d8999507fb
- MD5 830e1f97a297b42c0ed38e8d165db69a
- SHA1 b821bba6017acc180af9160a734666c2db7fb09c
- SHA512 cafdab34c4f8b50a89875f3d7341ef4244e1c65d17548626d87be1718bc09ecd772bdf2870bd7757afc0ba2201931c8421ff3330f0ee7e08fd7d75d289e9580a
- SSDEEP 768:s2uhZtQmjO603ACaoZBnI2g/wgaiWM3ZE9IBVY2MBnj8rmn+kkiOPxFj:YhZtFON3QoZBy33ZVVYdlOPxF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  ExceptCatch.dll
- Size 103KB
- SHA256 40d5ef8e438cbdf01faefc6c9bf913ecce533c102740716555c9a5bfe9657e8b
- MD5 c17ef9c194597572096713da10540c73
- SHA1 8e5b85765aa91305aea5e236fb402be0460050b1
- SHA512 83b952d917e79736edce2dbf00b2deafb8ef0f8f7dc67e5bf4e8993eca0186b538cad61f01758bf722b231efa39c68ad6a6e0c31bba7849b833e6efd9e3d2c21
- SSDEEP 1536:j9lx/wlFp+65eZD97Ddlaiwl3+Ry8vQlXfp+5tOguwgMuk0gV1:Px/Wn5I7DPaiw3jlXU5tOguwgMp0gD
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral29 behavioral30
- Target
  GF.dll
- Size 2.2MB
- SHA256 aaec4f9f9e189ca99f5a6e8f6d796d99accb739bdba83d6a3e8ec966d1bdfa93
- MD5 6fb4c7fe75ab3b8196c9e3b3c15740fb
- SHA1 568a102150f8ebd963c45c9157b937b6dc7083a3
- SHA512 b831a94088fd4b5192664f2fd374d6e85a8cec4d67bf8ffdb590d09b7d8a06924aea75785dc9199dd14f2b90fdff6b926bf147402aefd90189dd38631e6b03a4
- SSDEEP 49152:gyWXbjxiiW0umc6CBjS+iaCYtm3lL7Wwqo2wordDQwM:gyWXbnc7B++iaz8ordDQ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32