85264660f8c4772a68cb74acdb711ac32572b9ebe7f16fca11567abd19db7e86

Sharing

Copy URL Twitter E-mail

General

Target
745c19b51deeb86a090957d027841f77_JaffaCakes118
Size 2.1MB
Sample240730-rtxncsycld
SHA256 85264660f8c4772a68cb74acdb711ac32572b9ebe7f16fca11567abd19db7e86
MD5 745c19b51deeb86a090957d027841f77
SHA1 85187fbe2bf0691ee9b189ee919ec7dc170d1fc3
SHA512 ca581821c85bd85bd137d9a1a25f2ebb9bb3c07b51c09a08f240e017d1b3160146caae45b5e86352fe906ba645a2d373c38f53260b2f4fa59abd1bb518b59983
SSDEEP 49152:G/jcYQfkOChglUUFGxEzu2SqhoEwLHumaU/Hh+qYsRUzTc8h:qgfpCOuY1z2VKhsHhKsRcTcy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

agilenet discovery

Malware Config

Targets

- Target
  Epic/AxInterop.WMPLib.dll
- Size 52KB
- SHA256 c221c229cdc346570b6248e93fe2b807d5b619b4fb75b40fa5132e15a870a84f
- MD5 7bd5f148a044b2c846e144421bee3434
- SHA1 68bab716d68883e1cac6e1ce00a30413c4d4fb0c
- SHA512 7faa6e13e267d89f2403d3d9731684d520742961b4759ff72536e9548b9c392b3d71dd39f314c1741803e00906bc5f94f4ea117b713cdbae0538eddc2dbfe05e
- SSDEEP 768:RTiglqcPGmH+BSITBFo+iRdbBFS1WSbfi5qlD+P2mHvaVhXUWdYSXnj:EgvH+oETfiRnFS1WSbfi5qlsaV2WGKj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Epic/EpicV5_protected.exe
- Size 2.3MB
- SHA256 5bc4bc2acc9eb3931b988f9efcefdc151edf3a2ee021438969cabe97260e9567
- MD5 e44186ce05f2cebfb8d2e6d5fc0106d9
- SHA1 2b2910a1ef4f81e07b6d793dd2d20639fec68d94
- SHA512 30498c876593dcdd49cae8498ebe40f73ad666b8eb14724889005bdf66d6b6178a938cd34663219974c7908ae6a476e008cef0a46eeac6da48cab1acc9876099
- SSDEEP 24576:PQ9u98/1Xx+nuiSgGKT7dGK2vfD4HJCvOF6px6Z4+L7qqCnkUX4PkKwVELN2tJHz:+IT7sF4pC2F674bCk+QeVE6JHGAk97J+
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

agilenet discovery
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
behavioral3 behavioral4
- Target
  Epic/Interop.WMPLib.dll
- Size 323KB
- SHA256 978d63d08653bcb7692c508ceb2d7b1cb694e9ee10206f74548a935f1fb3782a
- MD5 77137c01be7d7cd6f759187ff97fb0b5
- SHA1 4960a3700fdffe0b061cdc1d9820974091065e66
- SHA512 a8b97035bb94d5ff5c65e11a9a9c3eec4e6f2d85bcaf54c432fa42e2b0f1df0d6c5aea4382cef30dea2bf5bf181bdbef783dde4dfa1e06375e29ab620904ddc1
- SSDEEP 6144:4pkr2dY/aBcjJOBHOBIQBajMtWvoJiLE1+XgRKz89G/4ZSb0Funwh6DsN2PIpCr7:4pkr2dY/aBcjJOBHOBIQBajMtWvoJiLD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Epic/Newtonsoft.Json.dll
- Size 659KB
- SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
- MD5 4df6c8781e70c3a4912b5be796e6d337
- SHA1 cbc510520fcd85dbc1c82b02e82040702aca9b79
- SHA512 964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c
- SSDEEP 12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  Epic/SlavSeal.dll
- Size 263KB
- SHA256 e18f2c1e6f08ad2adb6990b5599d2dfd2831d952b9db5967eb4b32c04c30641c
- MD5 346be4763db215dbbede5de8cd51f2a8
- SHA1 c0d00b66209a1258111eb50e5e4ceb610d5af706
- SHA512 d0a507bdc44943826f51ced8c9658115527195e83aa5e95cb57a1ebec6d247dd0fe18832d0afafcaab4ffe5eb340b0c0bd542207402521669dd27ba6c42c1467
- SSDEEP 3072:g1R+FFOc2K/MxS5UdgZ0FWU5JB/eGaVuzBmzaJQAH8OyB8Sg/UekYs84zfNX7gzp:gIMVKkcbeW9WQ0dyB8SgFA5X7gI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Obfuscated with Agile.Net obfuscator

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10