dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Sharing

Copy URL Twitter E-mail

General

Target
b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118
Size 25.9MB
Sample240617-e7s6waydqq
SHA256 dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714
MD5 b6c8ad2f49e3fe9eba546ab1d18bc2f7
SHA1 2360ab7f803088b920b2dd520ca83183c35593ae
SHA512 b523cc1a026fae65b32243305dec86f419e6eae4f78f1178ebff43c56f6c208394fd26c63acc4591a61bdbc5f9f564cf5b4dd9998faa1a67c8c99e392444ff11
SSDEEP 786432:z2wmTDE+Q/AmzNU6hR6r3ATesWO0SMiVP13:KwmTDEgmzNJ/8O0SzPx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118
- Size 25.9MB
- SHA256 dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714
- MD5 b6c8ad2f49e3fe9eba546ab1d18bc2f7
- SHA1 2360ab7f803088b920b2dd520ca83183c35593ae
- SHA512 b523cc1a026fae65b32243305dec86f419e6eae4f78f1178ebff43c56f6c208394fd26c63acc4591a61bdbc5f9f564cf5b4dd9998faa1a67c8c99e392444ff11
- SSDEEP 786432:z2wmTDE+Q/AmzNU6hR6r3ATesWO0SMiVP13:KwmTDEgmzNJ/8O0SzPx
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware bootkit discovery evasion persistence stealer
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/BDKVZipRpt.dll
- Size 224KB
- SHA256 c4d9c642d2f6f55be404498c236f2e732f4c63106a58995c0a14690b779fc372
- MD5 6272ed51c61798f786f51bfc7079c97c
- SHA1 000c98df6eea1dbd08c18d3b7f27715320ea56d6
- SHA512 6f2800f2b709ce98d5af391a817a5a79006b3bc50ced946b414ee13f05488118209aad63be533de22c947915a99868a52bab978d6119ca2c642db70108644fb6
- SSDEEP 3072:38JYm74I9H5cq+pQdT9llsu3Qt3d/STBfRSfwad91fK2rOgX+ECIlC:O5cZUIu3QtlSTBJSfrrOguu
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/BDLogicUtils.dll
- Size 282KB
- SHA256 25f671709f69b45a81f32d959e74ac71340ae558439ee96ba99094467a4d56e5
- MD5 c374cbabc15f274de9008881a84e7d25
- SHA1 7bc01142a2b7c1acf45a6728ec6f87b60a973f88
- SHA512 c70161222fed075f7e97c59c0f304486dfb2bfc9376040cb6609b53fdb0f1e2bbe595ab415624073902b0f40851800550ef57e494ba0687e1affd96b01ea09d7
- SSDEEP 3072:xjs9d36BeoRnBpu9VcEeoApyZfOVLURFXT1z6g/oIyxTBfwPlFT+7J2dftrJO16d:RUMBe4g0cIgwIoTBIPvT+w7rJO1YGm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/BDMFrameWork.dll
- Size 226KB
- SHA256 5149a8d1a0d8f361fe4060092164eb44f363b8d7958ee7327529cc8f9eafdb25
- MD5 d3e0ac527b9046dbb64a8d6b0927ede7
- SHA1 6144bc024e1b880ef9920d0c644f80b3dcbd5991
- SHA512 2079a76cf32e71d9c0bdda84a7ef9392e5a2e0f87ecd2a207e44f5393db59dacb937692b157ed54ef422e1ff088989a558886e95e34adc4813981fef894bf266
- SSDEEP 3072:B7nZmQXS6Rd9gIwEDP8pjT+qOWK9TMVQEcOPqhAk5:B7nDzf+jCqOWKSVQEcwqhA0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/BDMNet.dll
- Size 974KB
- SHA256 42cc622c89a84f5ef904c5387bee3d5044ea6868b64c5c2229abdc623410d801
- MD5 1b6ee88e783e03ba4079600bb0bea585
- SHA1 624db12afd6e605f957d4ec8e8cd30f8989d7628
- SHA512 569be0153fce2bbc16cc4f7b2781555a085456b9f4ba1894505ec145fe5945f7c4e5b76a15ea80a348b0aa8c991d5569b31403cd0a5ee32515286e6f99b358b2
- SSDEEP 24576:qs+H0L6ufPjw8lWDho1JWPgZYTDArOP0Zr:qZ0ZNnZYT0GIr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/BDMNetPlus.dll
- Size 886KB
- SHA256 9d7ba68f888e6faa003e089406d83218cdd99b19de867a8b84ccc59f71ce266f
- MD5 fff0616db65911080007bac98e198854
- SHA1 a71d486122a6c5ed65f0115bef6c491d278db69e
- SHA512 cc5116c9e6268d252a900d0483060e94f17fbec942ff4935db8b60e0dab3b798a8e81efc7b32a6721b8a00256e9f710aaa5c540a03107f1a5ce62428f02388ad
- SSDEEP 24576:FHJL4YHB7zGUldTddAxPVbXY6ZzTd8KS38j:1GyazjZzTK2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/BDMPluginMgr.dll
- Size 758KB
- SHA256 81d2e08f0b4aeffb418764037e6ea2a3c10ddb3de4ce4f29d4162bf1a080bebc
- MD5 9caedf3a0797beb008fe34eab1f8946c
- SHA1 9372563e8eae57c099317d6f00b304fa6767b770
- SHA512 a4fb7ca759817aaf45d9612dbbda01188009792a12f6c6a50d27bdbae4de70cc3571db07635efb6061a1062a4f48af52019a892a6db1ebd76a9e182e0fd70d3e
- SSDEEP 12288:LqPV43d7CXBmE4cJlYjA3ph8iLjHKZR1tRaQsyPYSdeCw29J9XMifqPLJK30a8XA:uPV43d7CXBmE4cJlYjWph8iLjHKZR1tZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/BDMReport.dll
- Size 430KB
- SHA256 29f1690afc465616d89dc59656a080f56bc563acc6d7ccb6dead8c34d4b8f38f
- MD5 b95b19c74b07460a74e48c1384c7e76d
- SHA1 0690be1b93a14ac492246351e0f320c9b47c670e
- SHA512 f8f94581666ed907649aeecd1ca0b935c3cc7fbf3ed2853b24cc87dd4eee7835d9884e4b38f8a43a4b3946cd47c832d46816ec0c8788b12768c420911fa77005
- SSDEEP 6144:ea5TcCazL+fUiqH5kPFuDHmvhFgXmM5sfhiMei9sTB7BB694/ODtMh:B14+fUihFjvgN5sfhUi9sTlB+4Zh
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/BDMReportPlus.dll
- Size 390KB
- SHA256 1301a2621e9e3afa3227cebe7ea588e0d293186d8b6348990fb2e60eddbec7aa
- MD5 a1107e5a84999908dee7fb1c5942c2bd
- SHA1 294cd4d6a3a792ed0f0c21100d81ddfa96539057
- SHA512 32b57c0f2158cbd9182f44398a73b9760d1347f6cd38901f61057e4c4cb0140cab0f7edfecac4ef55ae20e2a7e84d48dc544ed32646cc95e4ad6fc42c6e54c1d
- SSDEEP 6144:XibXVDA6GoGP/C1wAJB6tswRitgwhjr9P3NqROD4LaR+6:XibXqhoGXIj366wstgwhX9P3NqRaY6
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/BaiduSdBugRpt.exe
- Size 707KB
- SHA256 ddce99fbb9b667d6ad5d5bf00f336d1ac179738ecb1f8b819be28e5d6a4fe850
- MD5 50198e7aad301ca07024acd5360bb4de
- SHA1 20e6a5dd8929601fe9604c26b420cb19705d5a2e
- SHA512 5b2c25ffdc759121218c5d01dda828cb1d4e29ec6e33df1e93cd7fa6b6be0c09803852e395998879cb52cb3d81b2483e5662cefad22f77b2c27d409d97778e41
- SSDEEP 12288:rIzPhK7+vWfccgIGQrSp8v1ThZ1adGXnF+:rIzc+vj/QrSpkThmdGXF+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  $PLUGINSDIR/GetSupplyId.dll
- Size 108KB
- SHA256 e2ab61f602396cb75ff0745cf08c09ba6588163b34b9af93503e994df76a697e
- MD5 f1a3e3d2552723cf46f1e9aaa4741877
- SHA1 560603c05014691982a18ca3fa4eb9a1670552a4
- SHA512 88c0c24ca167c15cb788bf09d777e5957337b34cfa6af7329f889ea7de1a454f5fb3570c053f0f47ed79131df1a1749e32bbd1f48462da7b6bde19af093d290a
- SSDEEP 1536:AYW6vFwXaryVIpAyg2kJazPK3SPw+YFNtVy:jWGUdIipxm8NtV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  $PLUGINSDIR/KVInstallHelper.dll
- Size 807KB
- SHA256 5a7a171b6fbf66e399e2bb19449fc7bd00e94a2df800a64221068f77508ff0cc
- MD5 129c341be402821aa5ce06b596d241c1
- SHA1 8c9f65c687db02872626ce7a9cf530aac5765168
- SHA512 fc91d299b4f88f4e25a1fceeefeabc0bac6ba324c21c88ae05e53277011bded81ff88a8c2b4f196a181201753585532f303eb5b3e4cbd0909af646be8b0ed75c
- SSDEEP 24576:3nlqORLs3mUtrOEVv3QxfdgU0T39XABg9Q:XlqORL9EVv3Q87T3deyQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  $PLUGINSDIR/Report.dll
- Size 98KB
- SHA256 1d697cba0b02f54a5fb5759f0b5feca39dd272a35a8621b14624e9067d78c2db
- MD5 5767863541cde6995690b2a00bb32431
- SHA1 2960376d507ccee1806fee50453e034486daedf3
- SHA512 4cd00cbe833de19fddca291b30c965b8380dcd457dab553008722f92fe4841f2e85a71c09899be63ab42ab48d6621ab4dd88fad530907cd9c7cb993493a0e0cb
- SSDEEP 1536:UjR4Zllo5PYpKTQWxrDXQewk0BtXR3nhDtz2g:UjuZjo5PYpKHV0bXRBtz2g
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral25 behavioral26
- Target
  $PLUGINSDIR/System.dll
- Size 18KB
- SHA256 d23676fbcf76355d1af68e7b32964b837243349920921b2ec74d97554809a65e
- MD5 1c951bbcbc780046d6be1079a04870a4
- SHA1 a5bae7d838973154e6fac69b1c5ff7d2cda01906
- SHA512 62c3686baed2232f7d8ddc8f48a41761812b5b2a67f3a689b7a43275f077842366abc13c7e8259613bfd9df25cf467e4001337c1454aec910abce121d551e2d8
- SSDEEP 192:EN2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/KxDbder9ZCspE+TMvu/:7JoiO8V2upW7vQjS/MeMv2QMCpQKm
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28
- Target
  $PLUGINSDIR/file/AntiExp.dll
- Size 574KB
- SHA256 d252e7202475a601d11bc99b1f71cddad6d43173bf451894ae3337467e9d6b86
- MD5 8b7640b90a3a16c221134dd28a015a2a
- SHA1 94550bbc3f70cac117e8d372ccbd3c3153caa537
- SHA512 60c7673aff4ecccec313ff0323675c5ac7bbf4c58fc85b7a0f94f113fd8350446fdbdea9fc326d1b97cd32f1ff47545a237efc5d8cabf06ca434624c8400d473
- SSDEEP 12288:Oa4+APSIk1CsbP0tl/DTL6hymvMTzjgf43R04bT:ORl/2hyLTzjck24bT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  $PLUGINSDIR/file/BDConfig.dll
- Size 486KB
- SHA256 6da5b3222321574eb4b0c5041075a7dd750469f5f239c6bcf250a8a7f17f3b7c
- MD5 93e4a86cdda161264533584821e3ee4f
- SHA1 f29182b2d0ce575cf4b1b32a9313908b8e43358b
- SHA512 6b43850c8c5040f1c8daf2f7d213c0733c9b77204f90bb03be195a2502c5b03cf0bf5935ee7f5e6cc8b23aa3a9c6a77f0c7521a0a26beda162354fbfcb4be7ce
- SSDEEP 6144:KnaAuy95y8sPL6qraySVKAKUNel/hEv2DS/XdMHDmvp1NOLjw9xDhE:Kna3/tOyjM2WVMHivpWwHdE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32