3da6e78e2de91d5f9ff41af0eb84e6be790438a519d2bd5da50ff7bdcb38d8ca

Sharing

Copy URL Twitter E-mail

General

Target
907387e9b1296c8d48ee1bfa3eb1e51b_JaffaCakes118
Size 3.4MB
Sample240603-ee8e4abf92
SHA256 3da6e78e2de91d5f9ff41af0eb84e6be790438a519d2bd5da50ff7bdcb38d8ca
MD5 907387e9b1296c8d48ee1bfa3eb1e51b
SHA1 3530d38714465fe38deeeb35066d9d44f8285ec1
SHA512 9a244aa22aacb014db50d8efbd67f0f530493ae0eb393b9d574c37c01a8ae65a33acd1216643fd6da33a56d4f05b7d98194d093c735855e9e13aa7c765b4063e
SSDEEP 98304:+WA099fwHOOF/UgIzU75ZFkkpAXDdtAbOP:D994uOF/aibmkp6
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion

Malware Config

Targets

- Target
  l3oo/SC 1.4.6/ActiveThreads.exe
- Size 1.1MB
- SHA256 16d8e2261127910059cc311ef9c389382c7a625b0c059fe08d331300938f4ecb
- MD5 3082172061cf47b2cbcd321a9d87ce97
- SHA1 2461e6447d2a18690b59b86851bd6032d5d9492f
- SHA512 96d4e3da6f57e9dc1ea3390d6bd455b7e3bd908eace69fe213462b00b420b659ee328ff12763ea59e9a734e4bd6118cf12aa2c64f338ccfb25aec39756dbe5ec
- SSDEEP 12288:ZjEmPBpwZkTNhWLDS4Oq08t49D8vRFFfutlX1cndpffkLrOokuznHeKCV:ZgmPBGM8K208t4KvRW71gfMLrOkHeKCV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  l3oo/SC 1.4.6/DMP.exe
- Size 1.6MB
- SHA256 493293b564803c15460c1b6da295cd951d694f13e05cc9ad67801d6d18e98e3c
- MD5 a8cfbf3c0bdc7eff3d0490223261fdbf
- SHA1 3bf7c2a8de1d54965764517a8725a8e24fefbb1d
- SHA512 676a71f641a095946330d8bb952e802c04e02b7ca6ed3ca26c24921362aee487018b9ca61f8a402b33647aefc1c0c558af22a9f4afbbe68257917eb1667ed8a5
- SSDEEP 49152:ARgE3LIGEAVSmlsh0BQbB4ZaHY7G4VwXGTUDcs:ARZkGnVSmGKBQV4Z8CX
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  l3oo/SC 1.4.6/Google.Protobuf.dll
- Size 287KB
- SHA256 92698b4b233d6029263fe5f7dd83034e0ffab099451d4b889cbc11bf5a3f2d73
- MD5 8b961fb11cc67cad7b2ed49e2071a9cd
- SHA1 449dd1fa7cbf817f8caadf68b96c3fc5d709464e
- SHA512 da1c84f23dbcb8bfc0b0c00d917115c03727eb9a551414eff8824a119a115ed3d6d657d6809381c3a336cfd229ed599f2f5d5732523c4603f25a04eeb5dc7f69
- SSDEEP 3072:0msSJsFFVENd6fbycNO91a7Fj3EF325ys0dGednyRfonTPg4NTTdn9PenPOxQ6ZB:07SJsFfDycNLLr5ysEnyRmMKTdn9Psw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  l3oo/SC 1.4.6/MetroFramework.Fonts.dll
- Size 656KB
- SHA256 e96030fddaf7e78401567ee82480ad75ee48d3556199a3f85c0ec669edac2ef4
- MD5 612080028164b12939751dcccbb68d4a
- SHA1 db066593c63d2eff41a5af1b49a3e098b60e0013
- SHA512 1879c960e27e32941c0c992b84803e7a1f8d243bfc88d17d3d32baca772290b9ea60a6ea90d53170be3bf7f0a58fe71ec901dc66aa560b4bf68b1da56c09fe18
- SSDEEP 12288:H+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:H+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  l3oo/SC 1.4.6/MetroFramework.dll
- Size 149KB
- SHA256 baf326f52d39155d722465947f4cc67e6e90cfd0f89954eab959568e9bc342aa
- MD5 44538b311e9ec2bcf0a6452702628d99
- SHA1 da67301539903775708e9ec913654851e9e8eade
- SHA512 b65e3bc1c0f7b4c8f778cf52a36d628301d60aab53fdaf0355163e4865bc3d3adbf8870bb6cefc604708fdf2c0e72258eaf2fe301d524af2f77bc08014c9610a
- SSDEEP 3072:LU0T+erz8jYxYg5lzrPHlMUzxXd4kRZPI9q:vT+erz8jYxYgv/lxXGWPS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  l3oo/SC 1.4.6/MySql.Data.dll
- Size 693KB
- SHA256 e0a9d3343d1f43fd916f2e07ad1742737d46c51f98868f466f19e032ce997ff8
- MD5 cace87f0a8037a559e6b1b99b5f5225a
- SHA1 71bc09b9d479da9f8303da5186e48043c748e0a5
- SHA512 5f2b9d3751918b954c4b608ca485888d3747af9e174e763a5f06a4f5b1e20ac55125b7ad4e1533ea6ead8f5bce95eeee77249645394b800179dcb84f51c20f71
- SSDEEP 12288:ZbSmvSDO4Hwu/TbLmqmHRGik0DqET7GmbHR8wYKe0C:ZbGSuLmRRvKS7Gmbxe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  l3oo/SC 1.4.6/ProcessHacker.exe
- Size 1.6MB
- SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
- MD5 b365af317ae730a67c936f21432b9c71
- SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
- SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
- SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  l3oo/SC 1.4.6/SearchCheat.exe
- Size 410KB
- SHA256 1b931814934922ec9086ab56e3668214f50662f531a36e24c0722d83705f9b4b
- MD5 50416b8177f7edbdc4f220bcd18e51d7
- SHA1 8313648b91c989b87089596c7049148ac6fc15c5
- SHA512 4f08fcff8e3eafde855a14b66612e047a02372834c57b84a08664c5392845d96a53fc933f0389d9478e2f19fc5d3dda8fa6f67068aa3ebbf47e9b49efb3a4fb2
- SSDEEP 3072:RDysNxHnDvq5QvGO2x0gtlSgVpZb++WeTx0gtl8gVpZx+/MooxJk9:xyENnbCqK0YJPZDn10YDPZkTF
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral15 behavioral16
- Target
  l3oo/SC 1.4.6/Updater.exe
- Size 5KB
- SHA256 5778e21d26b03fa45e77bdb3de448dd0121852a335df451681d164e3ecbda3c1
- MD5 2405418539258e33534b687a1b773d5d
- SHA1 5fb8e138d1686fd121b6020510c055667115c3ab
- SHA512 ed7b13cc96afa59efe1c3791f05ad52876030a9d6fa15a50285b61e50184a0d66ddfeed88e4bfb875e04618e540d96cb5196d5a4d34e453b77f4d8e77081231e
- SSDEEP 48:673VTRxOsWOrixhaOkG8bNMe+NQb9XO+zkYx0LmZsFtR7l+oIfFipfbNtm:ETxOoEhaj+N+zkYGLwozzNt
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  l3oo/SC 1.4.6/appExtension.dll
- Size 130KB
- SHA256 4fce9dd494bdb79b28da576fa5aead3e220c8d37a3da1af90386c822d90a1c8f
- MD5 4bfd917fb83585a4d9c6494a698e453f
- SHA1 07071947075892342ea7259a554bc448cd119a0a
- SHA512 941fffc881aad9679421b6a411a33f215de100af6db9431944b5ceb2c667249be371ef30efeade9fcebe2d48585606a117592e882e5caabe83aa91dd202c574e
- SSDEEP 1536:yND9LcXkXn/GjLy/f7by9LfvxJOqnQ46+hsWNcdgxeoDh66zs6aJx82XY:29oqfqtXTjVmgxeoDh66zzaJJo
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Identifies Wine through registry keys

Suspicious use of NtSetInformationThreadHideFromDebugger

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20