5219b8b5a96f940b618d9e199d00a8faa341d08e01472b43f8f560b47427885f

Sharing

Copy URL

Twitter E-mail

General

Target

5a47563e8169e17655c706a0ed7d4d0e_JaffaCakes118
Size

1.5MB
Sample

240719-dyplnateqf
MD5

5a47563e8169e17655c706a0ed7d4d0e
SHA1

7a6ab84eb8eba010812dfb59ba11eae737a89792
SHA256

5219b8b5a96f940b618d9e199d00a8faa341d08e01472b43f8f560b47427885f
SHA512

66cb4090e6f64a969015a56d6252a5f80c8836c7cf05f142f6f6dae74f5ee9175f62ea732785705de1d168c3bc9159dfedc559bf4c4ec17c70cc4b5bca76470a
SSDEEP

49152:JTINXffUfWfubbkJT209IWUeYF4qam6QNEttfx4L:JTINvqbbbMIWrcG1tY

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  5a47563e8169e17655c706a0ed7d4d0e_JaffaCakes118
- Size
  
  1.5MB
- MD5
  
  5a47563e8169e17655c706a0ed7d4d0e
- SHA1
  
  7a6ab84eb8eba010812dfb59ba11eae737a89792
- SHA256
  
  5219b8b5a96f940b618d9e199d00a8faa341d08e01472b43f8f560b47427885f
- SHA512
  
  66cb4090e6f64a969015a56d6252a5f80c8836c7cf05f142f6f6dae74f5ee9175f62ea732785705de1d168c3bc9159dfedc559bf4c4ec17c70cc4b5bca76470a
- SSDEEP
  
  49152:JTINXffUfWfubbkJT209IWUeYF4qam6QNEttfx4L:JTINvqbbbMIWrcG1tY
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/DLLWebCount.dll
- Size
  
  28KB
- MD5
  
  0bdd7c6f1046ea4b42839f991ae53fb2
- SHA1
  
  cb9baefb10159b4a684fa1ee4372e7715865052d
- SHA256
  
  0a0019b2603dbc4505453c2501255ab0cc0b3c317ece4a6ce0cfb6a02a30907b
- SHA512
  
  96f41497f25d7bc81f51ab167f74243b4b767089c89c26f9752ef518fa60dedd2722c66ae87dad2334bcce1622bc12f7b9b892ae654ca58cecd9f35c9f1dc163
- SSDEEP
  
  192:OQoR7CK9FX/dVPWtJ/tXP88bSNwWW8+YdbDT:OQcWeJ/XPWtJxPFYi8nb
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/ExLicenseBoanCopPage.dll
- Size
  
  48KB
- MD5
  
  2c696c02233d2e2bc4d86f8487932304
- SHA1
  
  e2aa7dc0900b5e5e47200e3959f9e2c1985fdab6
- SHA256
  
  1276d4f2782f3872f6ec87c6474e1ce102721123fa763cf6f18de749089cce43
- SHA512
  
  972b06ed4a098961e348a3460b7a7fd1fb967d971ceb3f7b75e3d7c67c9a04bc24c1d4dae452af7d59fb48e93a82720b23e4d28720706815bebbf5702572a717
- SSDEEP
  
  384:pTC+6J7b+jNav0eUshsEPfaUYC+9bgZLw9y2P82zzEhKiXJeO4u:p56buNmS2/faUYj5g52bPy4
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  eef9e469e8a30717974499f277d97e2a
- SHA1
  
  2d33c25984ebd9116beeb55cdde4c5c86c023e5d
- SHA256
  
  1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078
- SHA512
  
  d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48
- SSDEEP
  
  192:8np6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTjK72dwF7dBEnbok:8p6UdHXcIiY535zBtMTj+BEnbo
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/SelfDelete.dll
- Size
  
  24KB
- MD5
  
  7bf1bd7661385621c7908e36958f582e
- SHA1
  
  43242d7731c097e95fb96753c8262609ff929410
- SHA256
  
  c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e
- SHA512
  
  8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f
- SSDEEP
  
  96:1dIrJYYrzPpqAAZ9sNIaI2y9WulXEGNRrG:nuYATpq/viyYuEYRr
Score

1^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c6f5b9596db45ce43f14b64e0fbcf552
- SHA1
  
  665a2207a643726602dc3e845e39435868dddabc
- SHA256
  
  4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0
- SHA512
  
  8faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a
- SSDEEP
  
  192:qADKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQbVUSF:qAViJrtFRdbmXK8+WVUw
Score

3^/10
behavioral11 behavioral12
- Target
  
  $TEMP/nsisos.dll
- Size
  
  5KB
- MD5
  
  69806691d649ef1c8703fd9e29231d44
- SHA1
  
  e2193fcf5b4863605eec2a5eb17bf84c7ac00166
- SHA256
  
  ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
- SHA512
  
  5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
- SSDEEP
  
  48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn
Score

1^/10
behavioral13 behavioral14
- Target
  
  AddScheduler.exe
- Size
  
  385KB
- MD5
  
  7da975101ed1394c0bb7bdaceca8c7cc
- SHA1
  
  81e08479d430b913afd1c85349da22a175d3bf85
- SHA256
  
  aabe282fd43631c77099e4fee74aa5cba445073b85a6548415a57a39612d388f
- SHA512
  
  8e04611444dac2b58078c55b109e5221994f2d8163dca98552d7f1fa761197f076ab0a92d0fc2f5d1e59de734dffa76d2730daadc84e7c3a3a007472090a1e9d
- SSDEEP
  
  6144:x7GS1D7K18xPMQvF01cwaP0SCS8GMSQSlgTJ9Of+F/p/uwONct43D92U:k8xPvv9P0SCS84l+TJ959pGHNu4B2U
Score

1^/10
behavioral15 behavioral16
- Target
  
  AddScheduler_.exe
- Size
  
  385KB
- MD5
  
  efa8215f153422d255a5e45f273ec97d
- SHA1
  
  679ee5f65f14ef856f0869ac8947117987cc1063
- SHA256
  
  4b39096605d5a02cec677e4f8b93baedc6636bd70a2dcbfd3815a82748346334
- SHA512
  
  37a1c76f7fc2cbc87be5a89d90ee3fabb6e2a9aeff4db167bbb7c3e01e2631e930d34532d2d1f8306b93cf1dd761dcf2eb8305d01974b28cf65190fda317d48b
- SSDEEP
  
  6144:Q7GS1D7K18xPMQvF01cwaP0SCS8GMSQSlgTJ9Of+F/p/uwONct43D92U:d8xPvv9P0SCS84l+TJ959pGHNu4B2U
Score

1^/10
behavioral17 behavioral18
- Target
  
  BoanCop.exe
- Size
  
  5.3MB
- MD5
  
  68612510f6053c5581e84418f97f1afa
- SHA1
  
  4733c91a6759439c614745362ae68ee4e31b9b2e
- SHA256
  
  b9b698e004ec76c1596aaa98771909766944a231ec5863729b7bd53d9fd8e391
- SHA512
  
  dbb6035916a1a912318919fa76b968e4af906e555c51f07a2eea39f1b0fa2bfe046ba438102d5ef144854168e1213064cc5294b7b655e19f9a3ae4dbc594c4b8
- SSDEEP
  
  12288:PxZGM2EnjjNpJ4zvn2jo8X0akLRaFEsW5wvTMNdxCHlpemfcSvfvOKJO6Hi5qOrP:PzxZ3an2SLRIET5wbMNdxaJO6HI
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral19 behavioral20
- Target
  
  BoanCopMon.exe
- Size
  
  992KB
- MD5
  
  e708d3887cb9e41b5ae0f738e91b6690
- SHA1
  
  4c7985c1b87f1842dc58f4c509a3d6cd1d6e006b
- SHA256
  
  30ad73b393f76a69d198a536f0ce1494217d10a945b78f7b113221825d6de97a
- SHA512
  
  78ad86f5d994e3699de8c4a161be315e0d36f7524b0e7b52253a5c28f3106922f25fc8ff1c152732316af4c28fbefc4947f025391b36a5afaab72610310cc57f
- SSDEEP
  
  12288:zYrBd5fLC+Rl0wy6g4GUXHeF3QYeEgjP1:zEdLVzGUXHe2/3T
Score

3^/10
behavioral21 behavioral22
- Target
  
  BoanCopcfg.exe
- Size
  
  600KB
- MD5
  
  f31df94ff5f4673c02acc8da834f75a6
- SHA1
  
  ef2eaaab110ff317d7af1e56cb03df5c1fd8f822
- SHA256
  
  dd875f22fe9683a3962f7c3154fe91c898922f44251b11a2b3e9fd11be3b1644
- SHA512
  
  d6eb4f7af120980f05287d5e920b7b33d7b50863936babe7e0a603ed885eb36fd4373160217c44369279cb96ef3386b550fa3100a3b51921bac08d5db56af277
- SSDEEP
  
  12288:JvQvd0cMQyzY26xiARcz+miVLnc3LLLLLLLLzC7Sm:Z/cM1Y1xiAq+miV7aC7
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24