e09d287da02d0f416cd389cd7ae620c9497b396fd5eb9b0340f2a8d13bf0379f

Sharing

Copy URL Twitter E-mail

General

Target
a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118
Size 843KB
Sample240614-b9762avbpp
SHA256 e09d287da02d0f416cd389cd7ae620c9497b396fd5eb9b0340f2a8d13bf0379f
MD5 a7a01d4e315bfc29e1508b7b4f27e908
SHA1 1eb5d96fe61422419a5645c891bf86d690f2a2f1
SHA512 f60a72c0378d86513bbc1ed069db2618e1cc55fe4c6264ac3058cd8f3129f8a82b95f66195af04153f10a97f9bb417be762304463c6ebcb1005a2ea2e18ab141
SSDEEP 24576:XodoXzjRDuiDiNTtRw0JhkdsTezBMOQtBf2SBd:nuyiXasTmxQtYsd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118
- Size 843KB
- SHA256 e09d287da02d0f416cd389cd7ae620c9497b396fd5eb9b0340f2a8d13bf0379f
- MD5 a7a01d4e315bfc29e1508b7b4f27e908
- SHA1 1eb5d96fe61422419a5645c891bf86d690f2a2f1
- SHA512 f60a72c0378d86513bbc1ed069db2618e1cc55fe4c6264ac3058cd8f3129f8a82b95f66195af04153f10a97f9bb417be762304463c6ebcb1005a2ea2e18ab141
- SSDEEP 24576:XodoXzjRDuiDiNTtRw0JhkdsTezBMOQtBf2SBd:nuyiXasTmxQtYsd
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsBR.dll
- Size 202KB
- SHA256 99378990a56718900816dcaf66c377e89216e8165cafafc0593b24b5262de5e6
- MD5 b505e79e29bd52d8d7d153d7a228dffb
- SHA1 9b7e08eede7e30eaf192ae1515e13cc8dd3962f0
- SHA512 9388211085d47ddad412d9d00b6454b086c0deb088272f6377deda90e08df1e5cfc7a754117c1a6bedea3bde66c9a63b5634bf82a8201e53255c538a4724c739
- SSDEEP 3072:7xZ5/bNy3DpLei+D3NlRSOykAIw+M3Y9igDjfMRg:tT/bUleVNGO2EkRg
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- MD5 acc2b699edfea5bf5aae45aba3a41e96
- SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsURL.dll
- Size 110KB
- SHA256 9f50688db497c70cc2c84558dcb71b19d076f983557f2b7de8a742fa804ba060
- MD5 6b997e803a10663fa4a2995c030ba1a9
- SHA1 3f81a5fc93601f04a4327ffd7c5a063dbf50a882
- SHA512 4cb8ecc7bb54c9e506e5061b452d474fd077b9f34b89384f54647dffabd77138fc4ad43e3fc14c6a65da21d72f655cf40560d53179a8317bb7b04382ff5bd776
- SSDEEP 1536:cuWFAmRWGSftKsou2XLQlJ34ecUzL+Tnc1QOz9/sWjcdBMFC7+j:cuWFtpSYsmUPtX+Tp69ABMFCSj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/tkDecript.dll
- Size 222KB
- SHA256 0ae09d65f5284409e6d9a2d40d7aaa8cbf1dd1815e67a9c12a9557f5de1f7832
- MD5 ea79ad436f5e54ee5dc2aba13fe1b15a
- SHA1 66e248962bfb1f370796dac393621367638c21b1
- SHA512 dbd40403126c6ef6f5747c900809140c8897376f03696247cd8d10431bec7abb0c7191761e8ea551cfde2234059ec087ffbca54510ddf0dc78b8329f598fab2e
- SSDEEP 3072:db0IC6Lh2wWcNA5ZX9VZo6w+ck5yUbTIQ2npANCrYJ5+S+cHOZjvqte36wI1:db0GLhqa8ZorcyQiTrcwZjiu6wi
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $PROGRAMFILES/BrowserProtect/$PROGRAMFILES/BrowserProtect/uninstall.exe
- Size 75KB
- SHA256 743db6766f6e4eba40a3ee18a794c9995dbb2c891cc8ae929d12d3ce0504405a
- MD5 e44f4e01f536961ffcd21866f36ee60f
- SHA1 3e63e3ab22e02f74bace174c0c0b21c33826226f
- SHA512 81f4898fcc10dc21e83a43801ad820608d2e9f7a50043668eddaf7276317b68bd36370982b6bdd2403371ef2177ac30aefa342248973a1068515a7d25eefdde0
- SSDEEP 1536:3fYBrbzmFizYwUK1G0DRXJCCEf2ielVGr+8LqFXoD1Dx:vY4FizYxCDRXJCCEOieqruV6Dx
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral15 behavioral16
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- MD5 acc2b699edfea5bf5aae45aba3a41e96
- SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  $PROGRAMFILES/BrowserProtect/BrowserProtectIU.exe
- Size 52KB
- SHA256 2f2bede54a8b5b2a5d88ae408a5ca8275f90929ddbda9a8301c69b4cc268014c
- MD5 d802c92fafdd7d2d9507bf7e028d0e5a
- SHA1 752210a3fdb41540a3b9a41eaa652860cb7496bf
- SHA512 c6616ee3e9687cf38b4a58d9c80aa275aa819455956a1bd92d0eca80720b4466d0a7d5680a72b3a219dad81ac405c674c18919ee77f8a0cf08606a4a87efff9d
- SSDEEP 768:cVyXnPcJtqW9b8hrdmEe+YEvvwCYZVDlKLtdSKY8YnAx9YgX7B1Du6+/SKWoGG:8APetqW94hB17vvwZly1XYABpKY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  $PROGRAMFILES/BrowserProtect/BrowserProtectIUW8.exe
- Size 52KB
- SHA256 324e94268783c904cc90b3675014bf4e20ef212fc03f2b8d79958f6d847a0cc3
- MD5 f618b67c07100caae467f60fe27e219e
- SHA1 fe766a532d2b704956bf5bd647e4382f4c2df135
- SHA512 ac99fd8e3dda1e2334f9c7b8d732feefd76dc12d4dc1390ec8c4f892080cc130e6b99542b4ca9556360538e1f2e8ec227bf86ec2d6cc7a1c2a1c4c0fe9282a8b
- SSDEEP 768:KVbXw46WtqW3b8hrdmEe+YEvv2CYZVDldLDnuyiJ1Cg1Du6+SSxzrPP:GU4PtqW34hB17vv2Zll501Th8xv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  $PROGRAMFILES/BrowserProtect/Interop.Shell32.dll
- Size 48KB
- SHA256 670fc71ea0168dd33baff537f228291664b6b6235058e01f885694a350bc9697
- MD5 c17c43d57b73f254d6fda553569b2729
- SHA1 ed0651e79c682892225532d98e4f99373f21915c
- SHA512 3987a172225fa074dd6b3c9b346600ba06785d21eda9fc0bc7eba5c4da08128d06deb29e6d37ff7966bc08256e1d0a78034d3e34257a4f37ff8618604d77203a
- SSDEEP 768:dexl81nX6ZxlvUAa7KoBv7epginbCe7AXjuw9tL0Duxj7tr+BrKFHy:dexl81nK34PJepgqcVzdy
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  $PROGRAMFILES/BrowserProtect/Newtonsoft.Json.dll
- Size 396KB
- SHA256 4624ddb20a69aa2c27377993adf6edb5e52292caf7b2fb1dcd91a078eeb10d29
- MD5 b67ed4bdfbb671169cc186e745d86a1a
- SHA1 c39bfc8885bd74c708a841180ec8a4cb8b6491af
- SHA512 9831b5b44d0cc38cbb02ea5f0812d44e079e62efa16cc7c494376ad20da6a00265926bf4fa99a0a148f8b650bb4de6e7243028d5afeffd6c904ab7e897fe47e5
- SSDEEP 6144:oirJ6jtXlvw1YRsWQv8MAOX54Vhsu27v1GmBhmLIPr0tqKx5g6e2Mb:oA6VlI1E/+kx2zd/QoKL3e2M
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  $PROGRAMFILES/BrowserProtect/proxy/myproxy.exe
- Size 247KB
- SHA256 066bb8d49c0a17bb0f391121709db85d307723ec541e682a96d665078647486c
- MD5 cfd558a1fa85a809ae86d470808dc488
- SHA1 470953b37076895d4d5e4aaf2cf6cfeb455eab37
- SHA512 352c4f470e8038c2662a73134afa52769074d8dffee0d5d45603816505fe272f267bfe33f79481e8afdbf5c8d3ecc4e61fdb27f43ebf9a39136bf14a7e391ec5
- SSDEEP 3072:eLUOd9Q6ZdmqmwbXymCrMD3PRexQlM+5Pm6SpD53usxHpWYoteP8+hJ3KC1Cvz:EIqmohferIPXSJwY1kY1Cr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  $PROGRAMFILES/BrowserProtect/proxy/zlibwapi.dll
- Size 127KB
- SHA256 22105576a2250cefb9d8b592d1e98474e8e598839ae9294842787b6c25f2f9f5
- MD5 639c27fa15b02cebfe14c3ffbf455387
- SHA1 199367466dd9f9e11674908f101107e1481a2043
- SHA512 ae4348f00b15bf78382a92ed2aa31531bb1dd21bae4b66ce8fc9439f2efe61743a750b7396656134ca0b5044ae2ce25953dbde4f63adda8a834c02edc5b33af5
- SSDEEP 3072:wDFjS+BXoIfvKpQsg3GKhtTBf3rcRpKa:MjXDfipPKvTB/rc/p
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32