Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe
- Size 443KB
- Sample240622-a55dxashjp
- SHA256 e28d8a62a7400924d35839bef8a6488b3727d1c1e80f4ef2ed044964866641b9
- MD5 008013a6ce6599a62ea25eb7c6734714
- SHA1 8c4b84fff8c09c5f97db7b18e3148b0b3f3c9ecd
- SHA512 f1c2fb06a8d2b8ed54c04b48422beaa7f80175457de85509c1350dced6cd1aa2d622c9a60684b2f7a4dc06380dc50d89089551cb9f9b6d817a7a4645d6c767f5
- SSDEEP 6144:KY94NTwpALBnkouqp0u9Pl22OkUnOC4zvQGF9IbhGHi5m0Z47b9IKaCuaIXh1eVP:Z9OHLxjm4Pl2kTlF9IbhGCIhV4xFU+yb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation rinst.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation G-Cyber.exe - Executes dropped EXE 4 IoCs
pid Process 1620 rinst.exe 1884 G-Cyber.exe 4000 bpk.exe 3716 G-Cyber.exe - Loads dropped DLL 6 IoCs
pid Process 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 1884 G-Cyber.exe 3716 G-Cyber.exe 2600 008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bpk = "C:\\Windows\\SysWOW64\\bpk.exe" bpk.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: G-Cyber.exe File opened (read-only) \??\P: G-Cyber.exe File opened (read-only) \??\Q: G-Cyber.exe File opened (read-only) \??\V: G-Cyber.exe File opened (read-only) \??\W: G-Cyber.exe File opened (read-only) \??\X: G-Cyber.exe File opened (read-only) \??\Z: G-Cyber.exe File opened (read-only) \??\B: G-Cyber.exe File opened (read-only) \??\J: G-Cyber.exe File opened (read-only) \??\K: G-Cyber.exe File opened (read-only) \??\M: G-Cyber.exe File opened (read-only) \??\N: G-Cyber.exe File opened (read-only) \??\I: G-Cyber.exe File opened (read-only) \??\G: G-Cyber.exe File opened (read-only) \??\H: G-Cyber.exe File opened (read-only) \??\L: G-Cyber.exe File opened (read-only) \??\R: G-Cyber.exe File opened (read-only) \??\S: G-Cyber.exe File opened (read-only) \??\T: G-Cyber.exe File opened (read-only) \??\E: G-Cyber.exe File opened (read-only) \??\U: G-Cyber.exe File opened (read-only) \??\Y: G-Cyber.exe File opened (read-only) \??\A: G-Cyber.exe - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin" bpk.exe - Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\inst.dat rinst.exe File created C:\Windows\SysWOW64\rinst.exe rinst.exe File opened for modification C:\Windows\SysWOW64\pk.bin bpk.exe File created C:\Windows\SysWOW64\pk.bin rinst.exe File created C:\Windows\SysWOW64\bpk.exe rinst.exe File created C:\Windows\SysWOW64\bpkhk.dll rinst.exe File created C:\Windows\SysWOW64\bpkwb.dll rinst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\ = "IE Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID\ = "PK.IE.1" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID\ = "PK.IE" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS\ = "0" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ = "C:\\Windows\\SysWow64\\bpkwb.dll" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\bpkwb.dll" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\Programmable bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer\ = "PK.IE.1" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "IE Plugin Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ThreadingModel = "Apartment" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR bpk.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3716 G-Cyber.exe Token: SeCreatePagefilePrivilege 3716 G-Cyber.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4000 bpk.exe 4000 bpk.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 4000 bpk.exe 3716 G-Cyber.exe 4000 bpk.exe 4000 bpk.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1620 2600 008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe 81 PID 2600 wrote to memory of 1620 2600 008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe 81 PID 2600 wrote to memory of 1620 2600 008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe 81 PID 1620 wrote to memory of 1884 1620 rinst.exe 83 PID 1620 wrote to memory of 1884 1620 rinst.exe 83 PID 1620 wrote to memory of 1884 1620 rinst.exe 83 PID 1620 wrote to memory of 4000 1620 rinst.exe 84 PID 1620 wrote to memory of 4000 1620 rinst.exe 84 PID 1620 wrote to memory of 4000 1620 rinst.exe 84 PID 1884 wrote to memory of 3716 1884 G-Cyber.exe 85 PID 1884 wrote to memory of 3716 1884 G-Cyber.exe 85 PID 1884 wrote to memory of 3716 1884 G-Cyber.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\008013a6ce6599a62ea25eb7c6734714_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\G-Cyber.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\G-Cyber.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\~sfx006BE01C26\G-Cyber.exe"C:\Users\Admin\AppData\Local\Temp\~sfx006BE01C26\G-Cyber.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3716
-
-
-
C:\Windows\SysWOW64\bpk.exeC:\Windows\system32\bpk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4000
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 256KB
- SHA256 b2b2779c2b3cefd672d4911c26fc080d0194bb583909f60969df78d5cf22f9c8
- MD5 42c570b6b8edd7cad8912209baf2bcfe
- SHA1 2c92df8c89590d4101159261e85bffdf944e3443
- SHA512 5b09282f0af64d926096b54d8ace779505de6b7fe425bf584a7778cc406845fccf8705a22519b868b60a9df49344e75d9583359d07a6fae26029850b7e21056c
- SSDEEP 768:Nf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:N69
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\G-Cyber.exe
- Size 512KB
- SHA256 17135961fc00c2d1cfe46d748931f5a211ab7ac5bee285f95b67949d3690f5c6
- MD5 c3e444795bc633f217174c1994d023c7
- SHA1 dadc21516ef6b2a52b46c4e15718905d2e2c65e5
- SHA512 b8345ea65b56cbbf6ff03d6f325689833d4fe5d786d7f76d9ef86d14cfa23ba9f46f5f9f4870090f0d64f40af7b2c19c2894bf702104f214093726718c296aa2
- SSDEEP 12288:BM/QLxjYCZXSd8yA9DQjASUy96Pf1jr81zV55z4q9:BMYlRiOLujASUy96Pf1jr81zV55zf9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpk.exe
- Size 428KB
- SHA256 43c09a323a4d637989d2646463e25c82b0610b48475dffcd16e44cbf6c757124
- MD5 9b993a562209d63a4e3426113ac1818f
- SHA1 c0ef09999bda7e2c56e23265ba354b30a6a66af5
- SHA512 299e4ec1f7771d00dd3d9cd0347370fb232a61f1d583e1633937e796f5c421e11fc3cbfa188388bf6d4ea2c8c1da31b438f1349d4c7019463464b771eb50ca39
- SSDEEP 12288:vFL/JYnjJHHZJMr05mgpW4Jad63eMsCOrdzY7TD:vG3W0a4JaOeNzBA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkhk.dll
- Size 24KB
- SHA256 edaf5a1aba7761e5577bc9f69de4315ced984c0b597f28ad8a5aed2839e92027
- MD5 0e5508eee48fbc4783af3ab985c64058
- SHA1 e8a529727d69c53d088d4bed0be5a6388929e0cd
- SHA512 f87c81d3fed2b8ff97095621e1836b41ea34ffd6200eab8a25c1f3874e3a76128ab98e061e9db44bbc804a05a7e7245bd4509e1ae5f4120098fef5ef191b79f9
- SSDEEP 192:wcQA0qb3NzYn7Cpty7kU1/GFmWSKCxD7nmTLn0+af8:wcQWRY7cvURG4jmTj7a0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkwb.dll
- Size 40KB
- SHA256 88ac5544f35b245ff75d9590d5e0694b88ce09ec7eba2d7053a3cd8ea915b382
- MD5 6c1a9aa0963daaebc8af244d50243a7c
- SHA1 850521cafd3d3c6176fa8b78677aa6bfc594374f
- SHA512 44bfff164ac152fb240ae3172f90a54be31ce206aafcff4dfb499b5eb4c9a80ae04fe68176c41a495a3ce691541317b469bce7be615513010dc62db306565360
- SSDEEP 768:qA/hhXkjq2J7h7MOTLGlnjyVjRybuCQ+HeFDnH:qmhXkpJ7tMgLijEovHeR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat
- Size 996B
- SHA256 25e6b3bbfa9ea164e74af06b39adbeb8ea857d5fde037d34d649049773905122
- MD5 74a433a26a414f98c4b47bded386d171
- SHA1 1c3d339d87708bfdf966a2b942cfb339b28bb888
- SHA512 697b00ca6a6527c7b4fba23d8f08298f86fef94c9a64b49e4aa8513ef6b056f8e25e6ab28982db87ac3e190515b548fb93a6c2ecdee0fe78cba767cc5aa0dc1d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin
- Size 4KB
- SHA256 699858429dbe04d7695ff93c740f435e7532b832e62b44f3b59f6f8b680472b6
- MD5 51df90d2fc61084a4df443d9410aa4b1
- SHA1 6cb2643f4eddf9cacf094821f88f4aee9073ff8f
- SHA512 6db9006a09b0d06e1a1fa76e99f099a9061d20ea93e91589c3f6be254c43121bf5fe4c0ba383662aef6eba61e76a9f2806d3d3f125b60d71b70e093fab3958c5
- SSDEEP 12:8ejv0v/e2BhdPgWulou3VKWsCBzUgwNQ39:hKLpjCBzUgCQt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
- Size 7KB
- SHA256 6bba0b8d8bf03ba15828c53e72d83d766e44b3238b55ab75348d8ce93bfd0056
- MD5 a455ca431e66975d886f1a8cfee8cb9f
- SHA1 95868529973c77199b76ec593a686d9b324dee8b
- SHA512 53e0c4edf9d91ebdea04bfb343c568190eaaeb066bc6742262f1e5943d2b27c375e1eca483419ae8753138dc2131c9d3c7742812c16863689c3bb266057c0531
- SSDEEP 192:9B22Blo4VgSAP1oyn5g1to5R8FPSmdvkEhew:z/lo6gS21Dg1tYR8FP1CE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~sfx006BE01C26\G-Cyber.exe
- Size 92KB
- SHA256 38b2b89e3f05c25690ae8da8455fd2ccf285a5b8e6c01b502e506112a3cd37fe
- MD5 a1b1fc34ca767ebcea641a6ad7fa58fa
- SHA1 79d4c12f0a841eac27c5d169e8c66cf408c7df6f
- SHA512 a89ebe407c0c49ed70e9fd9360206d6d38b806ee01e62248cffdf63e1a886a016529f216a8820c515d93dc9894d3efc2dad0b408682073b5edcf3e994a65e9de
- SSDEEP 1536:+JWm/sEKeQaKJcxvyMpLigvtgCW2QG52jioZgS1pxy:+LsEKehKJcACOgmJ6JAgGM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\bpk.exe
- Size 428KB
- SHA256 b966953b0a0e0bf648b1043b4e708445b52b020a0485921138bbf3be58d9995d
- MD5 bae0fb25bcf05a5da7fde8dce759ee0d
- SHA1 bc74b07d14a63ce572755c70ceb796136d129e20
- SHA512 74a61f7712df39194b2cb77186231d5960b8bfc5b37abdf20c357471a4e8dd8a8e648161cda7b1c8ee01d422926e3b30fd5ec9c6ebbf589a4feeaeba99ca2929
- SSDEEP 6144:9R1nwbWmZgZH1TTnXyCrze0O3+sv33Dyoo+ZbdYnvy367RtG95d6O4E6Iwq3L:t+WbZH1TLyCrlS+s/3to+YnvAERtGnd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\bpkhk.dll
- Size 24KB
- SHA256 525414ffe5f797ebdd7de5620b75ff723de17bf8f399ffcd7ddec2d0b8a5dc4a
- MD5 58129986fa29f6dacd99ab45f60bcb3c
- SHA1 7f21995794a060fc8629e0d113cf568de14c509e
- SHA512 62ade2d2eb41cd99dcd9f6d66e7966d129be20551faadcf827558e85d669f885ad144d10a87c3be7faed08103b86ab523fb6756b44f9e0ba77cdff586214701a
- SSDEEP 96:gb5+7aBt50ViCs602aK/2z5gPInuoxLKNhpUTzEvkulDOqKdtr5jposUGEEq6OD2:o50abCVZ0HtKI/k1Ucvkutnilo8EE13
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\bpkwb.dll
- Size 40KB
- SHA256 62e2948c3e3857e8304a657b7e7da30cdcb6842f71bd4c678a1734ebbf17198e
- MD5 2e6016325548ab79e2d636640c6ec473
- SHA1 586e2b84d46ef00e26c1686033def28e8a9995a5
- SHA512 1dc89b9e15f5835dff3203e278f000df5c0d8d93cbef5059be3f1024ef1e16ae8087a4f8e1131b20b190942984e9dc6079dfe951a52de7f4d4ad7de8721a0e86
- SSDEEP 384:RQvSI66SKSh+wxcmtaby7aXE9v/dkTA00kwmL+qG6HlH9AIvyyryQGwHEH:RQvSIzxSpjtja+xtnmL+q/lHaErVvk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\pk.bin
- Size 4KB
- SHA256 96e1b86620a71eca495e3ae4a3e3fec02c8aa39dc382f3a37515ed4be38a1e28
- MD5 e2392786ae167b46eef9334c4f7f6eeb
- SHA1 2be821df587654f7e225ee5c7af5f308140803df
- SHA512 e4355eac3e689767ec39f2b8a7af1a4ac0229577aeb1d80b9bda19c7ba443a745246d5ac625477fabf07d81b1513159cab3fe1ffffee704596d25ccd506da3a3
- SSDEEP 6:+Y/tikJHHgdcQ/6/GxkGcp/O/G1Eyekq/u/l+IFJ3AMOu/Sv1GMcsxMKYfcOg9PY:/i/i+kCcJwMTq9GMcsxMB6nk3
- MD5 SHA1 SHA512 SSDEEP