jigsaw | 9dca05d456e7a2f665bc3d92c883574754718441a6075de6d09a918e67ae1035

Resubmissions

19/07/2024, 15:11

240719-skn6as1bjc

19/07/2024, 13:39

240719-qx588sxcnf10

07/06/2024, 19:08

240607-xs7d3acc4110

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_9137481ae47cb028ea325c76a6298798
Size 24.4MB
Sample240607-xs7d3acc41
SHA256 9dca05d456e7a2f665bc3d92c883574754718441a6075de6d09a918e67ae1035
MD5 9137481ae47cb028ea325c76a6298798
SHA1 2f9c8d2490566bb08dcb3c6666cf204392d2b317
SHA512 4b17225458d0ac9e5b916c15cd6cb89c493af480e77bf001ad8ca6cfe422ed454061c36b2a843277e6711f164070d1baa5b42224f228bc059311889e9285de90
SSDEEP 393216:fqxZWG6E9nJi+AnsobtOKLzz4F0Cb7E+SVCibwjVpVjXrnharBxdsbK+u4XAfrmY:SC/eJi+AsrKCrEBrwzVDrnhalDI/YmR+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  HowToBeatPayPal-preci.pdf
- Size 3.8MB
- SHA256 d129fb349f777afbff5b9d833c547b809b4e2a37f56efc030cca228f1049b981
- MD5 ebf7b19ffb7eac4ed326636374c7fe18
- SHA1 a2b8e6bf659720d1537e416b70fa015ab7abb8ae
- SHA512 7c84cf201d3032c28a9a143fc64537b999e9117ad092e01da2838a17a31dad61e5f4d5970173169c173fd193d13b4afc3e8c29744f5aa8507aa6c472a90c0d3f
- SSDEEP 98304:X0Wz6vrunXB6Q1jXofcaRgxNDBYL/XrZmtYt3jKz:kW+vreRv1rofclDCh4YZKz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  NEW PAYPAL CASHOUT 2014.pdf
- Size 679KB
- SHA256 b77a664c1dc520e85f4a6b7ddd8049b50eb4052b20a01e2a94b3345777f41ae8
- MD5 91d968587dcf2a59e28d35cd4ddd18c4
- SHA1 05ec0b7512a0bde9b1dceef4663fff7772c11bcf
- SHA512 dbc5ed3b1a996e332c3e139982390e79de0c82f5815b4d8e15f7cb11bb4872f6eac313ae298d4b19bf4a3e626d32b9270a00a26fb2d4049eadcd947bd6876652
- SSDEEP 12288:jpSeeG4cKCz94eviwnFIKA0uYqjoTRE5K36GMGDl8IU8vBE0Y6t6t6cIOgv09zOA:j0c4cKCz94ejnGx9jcROo6GMGDfU0B4n
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  PolishPaypal.pdf
- Size 40KB
- SHA256 1913f5048d667984b35b89f695b26e52d398034d222736c1d0d5120a9f8431c6
- MD5 8ccd0910daa227a0333e7198aa698a8e
- SHA1 0232b99524d17c26fa09bfa2230f5fb7aadf433a
- SHA512 a9286c7d1211992f81cd88bd5f33142f6beea2e71cd311cdd52878e84900f6476c2254879a56f3da5e69992e63d9cc73b4a74c72657e271e63269efdc69eff71
- SSDEEP 768:TN/EfO0OMYgixR0HsWlLox4Vk4PBO6tRckYl0HPfmd1a4dtkRgmT2nMDzssdvJfd:VE5QgUyxYGr5xRckYl0HP+dQgs2n+Rl
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Profiting from Paypal - TCF Wiki.html
- Size 32KB
- SHA256 fe8e7883656dcdf0ff4a05c3905397aeeecd0c75cc4b5d06b80e1536e11bc989
- MD5 f69df598aa45d488ec12cc5438030ab6
- SHA1 5ed2d3740dd741b5a1be1d7dd0d1c43f64d9537e
- SHA512 97f0d6dc1d0a51576ddbe80424898e2128d20021aea0c79265747727c645a74871178dae01cf8960baee4cb8c2fdaf3c2b18efc43d5dd85b66103420813dc325
- SSDEEP 384:aMPfdUrfTVBFPzDsjvr9ZMFgTvGoDYCvwe4yW165e/hVOl1i3mVCDLNZpc6TU1zx:aMPfEh7LWxZoyC6OgivZpcTaCW4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  ScrewPaypal.pdf
- Size 550KB
- SHA256 77be8e5c9396e4bc657387abf1ddf88b2ec8bdab60dc3477ae74ab7e03fea6c4
- MD5 811bdc8ec33febb0cdf3c4954f3031a4
- SHA1 5a3361b378827661fbdd3f9a02cc4d2c57826e14
- SHA512 a7fe181b945c1a4ad18d0b8ada41f5181c8fa3cd146c982cb1611e1b873426aa4a708c51af8847c6e0ebdc0d32e3f11a75d0f54ddb14d74680181f060e7e8ae0
- SSDEEP 12288:Q4aZSMas5zyPlrc6HxXcBeW8DIa8VmhGQgprWXrM:Q4sorcWIeHD9E5rWI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  StealthPaypal.pdf
- Size 42KB
- SHA256 7f9d7cd4ab9fa79b9f7eb9a0eca83e3d781fd2f5f3ebeee1e9e512cd34516f3a
- MD5 092078d0a61b990d7aadb2371e89bb11
- SHA1 111d35a7df2f1bc11fa3f9a96f732651a6a795af
- SHA512 e1d0d453a48397f1763f833ebf2ded481daec1a247eb3e4afc8b83efef16e537edc44f586b62e292f213f8f9c8c11516dcfee324e1c5ed24e032595da649f756
- SSDEEP 768:KPLQDLTsav4O6Jd4irWtuZbMLCpMfEnOZz2BhGS0k3HN1ZRZdZwxlCFJ9:KzQDLww2BWMZ41s/huUHDZRZ1r
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  The Ultimate Privacy Guide.pdf
- Size 991KB
- SHA256 49d70057e256b152c80457d63d8e44c08eecf317d3b5f299f799acc13d5a6ed0
- MD5 89839cc54ab6e3cd85c06cc837631719
- SHA1 a25065d5301c838b714261d2c5e0e0553a93ccd0
- SHA512 54b6ffb3fb348df612a5e02a6c2d0461e7cc0996ea054eaeb118e3b0253032c08b6696ee986cc193cfb11c762b0652064660d33759e6ec62a0a3059172149fb5
- SSDEEP 24576:A0bbH7v9TzRdnipNb0QN+BhPD21/tChaaI+Pizvsov0Q:RbbHpTzLnu0++imiLXv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  Unlimited Stealth PayPal Acts and how to Cash them out.pdf
- Size 51KB
- SHA256 29426b26f770333e3ce92e61ba0e6c6508679655a023ec64185c32e5ec534821
- MD5 8cbcfd4f65421379598628918a5c6048
- SHA1 cff70e9a589452810b997081c7dede8c30163e40
- SHA512 accb1ac7e99c3b65d7d72ec5365271ff01fb04ef02b07806a1da1f52371c141bd46cdaae3920ff01940656fd8d94b0bc1511b976a7059d5f4c43cc1934b931ce
- SSDEEP 768:uN2QunEdL3/uh54q+gideO6Jd4irWtuZbMLCpMfEnOZz2BhGSc0rfpR5j9BktMwc:utL3Ghn40BWMZ41s/hjc0r1xBktMwuSu
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  Yasuo.Paypal.v4.5.5.5.lnk
- Size 3KB
- SHA256 2cf631d3527853eaa9d486915707cbe570f82d408c16d84aa530ef38ec594296
- MD5 5d6276cdb3f840dc5c5a6c89a42a8d6d
- SHA1 c4094dd18d14f214392709a7da2b8d47649298bc
- SHA512 98a91248ad60fa91633c29fdf72d379f0b80f24b030d704079f2b9a9689e298d0d064bbcc72d6d37e37cb04802e9c3f31bcf8810440b5fa50dc9845a857ba27f
- MD5 SHA1 SHA512
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Renames multiple (2480) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral17 behavioral18
- Target
  files/Yasuo.Paypal.v4.5.5.5.exe
- Size 436KB
- SHA256 a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710
- MD5 3bee1d24189d4941f68b96da6e207be4
- SHA1 dce911b1c05da965c8733935723b88bc29d12756
- SHA512 a40b01c630ff2c4b90a2e1bbf285c5d558193ee0fba79a3210a56408087ca828292269945e3202f65b8eb038a565b1ea8a18d185864ba9dc4073a3633c86ca29
- SSDEEP 12288:5l9mnmYK1bcy9oNm3/oK14MfZGLBddXLA:cqzONmQrBM
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Renames multiple (2507) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral19 behavioral20
- Target
  paypal stealth.pdf
- Size 373KB
- SHA256 eeeeb3386414e348a81ad42eb2dcacbe9a2789a25ccc1d6aacd3c6dc0b8ff50f
- MD5 61406112e7319aa050b000ea0c51bdbe
- SHA1 01719f71f167d7eca75608d2b334d5f581646af0
- SHA512 c62e640f0c49afb06d6ac799280bfa5661477b80c502f71dbb7841f517afb565c5c5c1ccfac6c12d33d3dbb0eb41d25de7618397ec3f78cca0ca5f42577fccb0
- SSDEEP 6144:ges5xtRuyQ55VY2hpW02Yo38ZoFkLAUL3wfsvF3lpgHs6Tzwk/gYfkh:4tRuTS02D3IM2wcF3lz63wqgYfw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Jigsaw Ransomware

Renames multiple (2480) files with added filename extension

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Jigsaw Ransomware

Renames multiple (2507) files with added filename extension

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22