General
-
Target
a533ab86bc7b1bdcfd05ff0c0f20b61d_JaffaCakes118
-
Size
17.5MB
-
Sample
240818-dx1mjawank
-
MD5
a533ab86bc7b1bdcfd05ff0c0f20b61d
-
SHA1
3511fa2f11fa1706bf9c14b725b980717feee396
-
SHA256
1ed88842968fc634ce7f3a0ec6436ed087b0e4dbcd96521f3182e7d89df2199a
-
SHA512
acdc316a18adce70c61440230624c6a35525f5624f9bc5989b2544424441f37f9e6fe393775bb40d19881f4c93aa93fc82809c3216f5f70edd74d5a52f3f3659
-
SSDEEP
393216:zZMEQ5cf9wDDyuIKy3Qznr6d/Pf2KsGaoc6GZmJONTshFHo6r3ELG7r:l7f9wKKq0r+PAgSUiT25TdP
Malware Config
Targets
-
-
Target
a533ab86bc7b1bdcfd05ff0c0f20b61d_JaffaCakes118
-
Size
17.5MB
-
MD5
a533ab86bc7b1bdcfd05ff0c0f20b61d
-
SHA1
3511fa2f11fa1706bf9c14b725b980717feee396
-
SHA256
1ed88842968fc634ce7f3a0ec6436ed087b0e4dbcd96521f3182e7d89df2199a
-
SHA512
acdc316a18adce70c61440230624c6a35525f5624f9bc5989b2544424441f37f9e6fe393775bb40d19881f4c93aa93fc82809c3216f5f70edd74d5a52f3f3659
-
SSDEEP
393216:zZMEQ5cf9wDDyuIKy3Qznr6d/Pf2KsGaoc6GZmJONTshFHo6r3ELG7r:l7f9wKKq0r+PAgSUiT25TdP
Score7/10-
Loads dropped DLL
-
-
-
Target
$PLUGINSDIR/AdvSplash.dll
-
Size
6KB
-
MD5
13cc92f90a299f5b2b2f795d0d2e47dc
-
SHA1
aa69ead8520876d232c6ed96021a4825e79f542f
-
SHA256
eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
-
SHA512
ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
-
SSDEEP
96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
Score3/10 -
-
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
325b008aec81e5aaa57096f05d4212b5
-
SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3
-
SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
-
SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
SSDEEP
192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score3/10 -
-
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
9384f4007c492d4fa040924f31c00166
-
SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b
-
SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
-
SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
-
SSDEEP
48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
Score3/10 -
-
-
Target
PBWS32.DLL
-
Size
38KB
-
MD5
410d09e8cd553a560386c5a76f265cf5
-
SHA1
30488587ce89e56f21ea9da7d3b172d93decae0f
-
SHA256
8e55f3ed041daf39b531b20f4607111f2175dea1ddcbb0645b07c5fc808ed240
-
SHA512
029c06457ef5b41f75dd7640e8d8c9eb663b9e190d977e9dbccfc8ff5181dc0b9d39cf4d72b4defd6542f0c0890e775f2d4cf974a6074b5f5009d5e29729f3ba
-
SSDEEP
768:pngliMfJPJ3qSGA+LPBVAx8Lb2AUCTMz2a7easJ:vm3hG5LPB+EU/zfyaw
Score3/10 -
-
-
Target
baro.exe
-
Size
6.2MB
-
MD5
1c4c8fdffa62d2c6b0ca681fda48f86c
-
SHA1
60efa26ff63e91b8762d36b453f14593ff1acf8f
-
SHA256
0a24747312d2d47cdc2b8b250c0a692f57d251a1725ca5e1434fb23cdaf56c63
-
SHA512
3118d7b6b0f9a2c784ba56ef5335b45852f3d1019960bb6366d9a1e84e6e20ca89e83de5ea3b27b16277b50a9c7a2b4e70b19f0f72e950a05eae80ba4c59aeb0
-
SSDEEP
49152:XAxE7wbPoEROyeHwTXigt8Xhqu24tOsSfxym0jIN3X:XccfyeQTXiCK2gyUm0ju3X
Score3/10 -
-
-
Target
dll/FreeImage.dll
-
Size
3.2MB
-
MD5
2513b9e999605cf8c42a8aa96837feae
-
SHA1
76dde6500a044ba14547a648939ac11b1eaecc73
-
SHA256
242d585b09c90708e5d626c01cfe0e474a2dec53b80e8d7aaa8a5a6b0b9f7323
-
SHA512
0d876cb2ea35dc1a2c17adfe592bc2bb6e4075d3d86c39e3b1c0803e486fb5a90f9720c8565d936adff9b2f8bacf08276a9fe0054a1d673a62fb2be6774ae7e6
-
SSDEEP
24576:71sXq+eR0/+qT8tLVMN8UasVK0dRk/IwBO24GXrkL84hDvJ4/RCZyCVf4Bxky1Jz:aBe8PAU7SEyhIGbIeT7SwF
Score3/10 -
-
-
Target
dll/Interop.WIA.dll
-
Size
44KB
-
MD5
858dd3d914c467b8c2326f015d927aca
-
SHA1
48c836f62bcc9ec1c7dd7983c5bce9bec49c3db7
-
SHA256
a9f47fa2b08f86fc7815c62321f71d727ff052288d01af09765ba5dd87f06ce0
-
SHA512
cdaa609b8ae775a2c3b68415d368c51ef8cc67d9ed63e88a8613c809b4af8ac7975099f3f3941616b154065ecea60010ff90fc3cb92879711178abce0a4affc6
-
SSDEEP
768:mvlrTN8xKiauFV1A1ZFWOmsQJ8m+N2wVZMc3jN2:Mlrp8NHmiBsQJ8m+MrAjE
Score1/10 -
-
-
Target
dll/PdfSharp.dll
-
Size
568KB
-
MD5
f9a4afed4a99e87450a359c3988c43d0
-
SHA1
2a9082ca8b5276cb080c566277370680d48f78e7
-
SHA256
6175d361837348f401db75f7c3f9ce541dd84ae015741feef8cc921398953176
-
SHA512
b74b0a3149594fefb5e8972eb9baa3f953962fe9179de7db77d9915e9d7710612fc58b74d2296c64c9ad3033c7cc45e76d59fe32471a8ae0b4b309cd0017a600
-
SSDEEP
12288:8GBiN8GPX1MfQlhbeyIVr1KWqVw/epCEbmgldA:851cQlhbp+D/epCEbmglG
Score1/10 -
-
-
Target
dll/RegAsm.exe
-
Size
52KB
-
MD5
4b63f5e28d8e2ed769cd900bf0709c22
-
SHA1
8cdb6b0f735adf9ccf5cabd96df56edff72b287d
-
SHA256
9e285994ac0c76f4b8b85878e9288972c512661c3ca089c23ec6713740510a36
-
SHA512
cca29d8ffcb2829c23746b03d381c6cde5d44ceb96c99828ef73ec4f420ab239a641e7c3dd496ac75e65cb30b391ffd4a410f361e9b0d13b7715b48283a7bc22
-
SSDEEP
768:L4P2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2ZWFRJS8j:/Jv46yoD2BTNz1+M9GLfew8j
Score3/10 -
-
-
Target
dll/SDD_TWAIN_SCANNER.dll
-
Size
22KB
-
MD5
95169eb3b1f580f7b75b74709648aab0
-
SHA1
ab4dae1b43c3d1350112ae6413af83997a4c5f0e
-
SHA256
d124c1827fcb11f398d1933a2619d6a7ce5c4344ff7fb9f9a4949ebfd9a33ece
-
SHA512
8b9dce4d6e21f58f0ab62cbae260387be56ca95760390210595d6646465fbf94eb1854c9513c7ea040d15208cd953d38a2e1b33dc399a0a85826672c132613fb
-
SSDEEP
384:GsMi7JRo7cYVW9b7L0DRIoO63l8BiPy2RM9HlGF4gKoeAWq:ANVkvL0DRIoO6eOA+Kosq
Score3/10 -
-
-
Target
dll/Saraff.Twain.dll
-
Size
52KB
-
MD5
dfd91064c061ee5a3245c936daee1d6a
-
SHA1
29db79f7b45611d769467f4e063ef00feebe5073
-
SHA256
2a92904383d482d5073fcbd9c2cbdc115c6fabd171a8173991c1992bdc01533a
-
SHA512
e121b6b0320a15499d0befef6adf0ce678562cf3185451393f563bf9335f39ac222c1490d6057db1f83f9cca63cd8e7485e245a05bdfcb5235d570593a517448
-
SSDEEP
1536:7SoLvyDjdUdQHUGSar8BrxvRC5RIt7Sz19:GUvyusBSRrx85g7Sz19
Score1/10 -
-
-
Target
dll/System.Drawing.dll
-
Size
616KB
-
MD5
3716fb11c20e313d2deb35e9a73a05f6
-
SHA1
a26cecb78abc8f45913968bcd864a18f26ff165f
-
SHA256
7b92496ac930d5f891654f3b4d3ecfa2751dbc86df314c1a141801d1ebfe8643
-
SHA512
f0c7fd525e8a4d3642d9ff7b88b6081bc19126a92b3497de1ea1677416dbaeaa5b8e0be82d8344f0ac253f86d01ce66e10472b5ad654772c896871243ab503c7
-
SSDEEP
6144:y/EoafvVBEQUIHx0lqYuRk5ydBZCpPSUC0ixkapt6i9SiSFqBywtlnISJHDEnChp:wafvVBDIQ6Knt6iHyqBPV5Rr9
Score1/10 -
-
-
Target
dll/UzakYardim.exe
-
Size
740KB
-
MD5
10a524d7ac94678ae286b065421647db
-
SHA1
b538e3f113817c8237419310ef47817d1d961fa9
-
SHA256
55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
-
SHA512
928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
-
SSDEEP
12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy
Score10/10-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
-
-
Target
dll/WinSCP.com
-
Size
286KB
-
MD5
0317031c87b6626dffba1ee7572767d1
-
SHA1
9fe90dbb9a65f87c48bd0448c786666b6577906e
-
SHA256
83fab3dcef92514cf1f41ac458fb8b7dc5a93ac08cbf2d55d1c5989c66a27707
-
SHA512
51125d3cbefc61c87949df26836da60f6716b9f36df1bfa56af63f1f7e20b386b60a0587233c56d05fc66eb206dbab46098dc4c3ad1681e622a7949b145f95c5
-
SSDEEP
6144:SeoDiHHL7SIZaHBQuN67mUWyQsJwFqwckA/H9No:S5USIZahBN67mUW3AIA/c
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
dll/WinSCP.exe
-
Size
9.7MB
-
MD5
970f87e2a609b122a20667b5376a4847
-
SHA1
4231757664a14a38ebbc4403f5c75230301f3db1
-
SHA256
db21dfaf2a143fcb48d98456ecb215d67f6484961c94244741d88569c033f410
-
SHA512
93a9900ba13fd8f5f87b5d0d3fba535c9fbaec1b73c8db831bb2dd02050438b960393f8cb0cbffefb582071f919dc3501bdd73fe1df33f36acf3322e23be28e9
-
SSDEEP
196608:qsGchj5i2yHc+3D5a11Gv/8LBZHNa+Ra91Ojyft2SKdunyXvA8T28jGRI7i8Pw6E:q6TkJp4MKF8pqPrcH96+8ox7n9
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-