cab43de74702f11eee7a9913a355863b17ebba7f5eb051120bc9fce8aafd117c

Sharing

Copy URL Twitter E-mail

General

Target
ada0df545bb77455e0f1764924944472_JaffaCakes118
Size 4.1MB
Sample240820-dfry3athmq
SHA256 cab43de74702f11eee7a9913a355863b17ebba7f5eb051120bc9fce8aafd117c
MD5 ada0df545bb77455e0f1764924944472
SHA1 1a4fb4d155c8231498973294ccb754a40be71159
SHA512 5662cc34a7df52d7b7c6de4883222916acecae3daaad39b627e8bc081a328ade7a0dddb87747ef018fa2ad2ad3109c5b322ed475cbe0d4bdc4b497aff18d0517
SSDEEP 98304:UGXiDU0/61VWHNQqjx8rxJt2e8380ZezozWMB:RT0/610HC72xQEztB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  Combo Minecraft/Minecraft Checker/MetroSuite 2.0.dll
- Size 305KB
- SHA256 8604bf2a1fe2e94dc1ea1fbd0cf54e77303493b93994df48479dc683580aa654
- MD5 0d30a398cec0ff006b6ea2b52d11e744
- SHA1 4ceebd9c6180a321c4d4f3cfb5cfc3952bf72b45
- SHA512 8e06ff131a81e73b1ff5de78262701a11ecc2bcdaf41011f4e96f11c5372742478e70b6a0901b61953c21c95725532af8d785654405ec5066ad157e2143467cc
- SSDEEP 3072:K6J2UBugOAI+yjNDWswy1MNo1EvnvkgvloSVQBjDifX0pPSRZ9KZdf8uvqtXfZBF:K6Jr8xhFzfOaa3xqQnQGTO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Combo Minecraft/Minecraft Checker/Minecraft Checker by xRisky.exe
- Size 2.5MB
- SHA256 aee7b1aa2aea4d68f2dec1b7d4d704640c202152bff530ca51e19add52d5b5fd
- MD5 5e437613c9ff5ebac652c1bcdfd3b09b
- SHA1 68d0706818698a8abc16964e405b601076abea40
- SHA512 9ad15bb1ddf44bf9ffe333af94847a512a76b58de337189e0748495c3f7a1f8c776a310d773412d299f73c89db72b9f7c68543d43137c5a1980ae8f3e2dffd9b
- SSDEEP 49152:3ITe1ItLD2qOVM9q9QhRp8Xbo5AaT0cCRX97S:JGpaqQKQyuo5PT0G
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

agilenet discovery
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
behavioral3 behavioral4
- Target
  Combo Minecraft/Minecraft Checker/YouTube 2.lnk
- Size 1KB
- SHA256 b3bb48a747cc7078d4c4c5bd872a270b59f328ae90a85ef3d955b8a4892bff41
- MD5 deb42bbec322cd0b8319f788312e28c4
- SHA1 073d20ea0feabd59943fefff0b3a2c5ff320e1bc
- SHA512 c4a9bd358dd225459410bcbe75ded4f514b708ff3799b1b56da388718d178ef6e2966ba8970a0bda03a42d65dae27973709de360582478fb24532f9d8b800e5f
- MD5 SHA1 SHA512
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  Combo Minecraft/Minecraft Checker/YouTube.lnk
- Size 1KB
- SHA256 bde117478e44d3aa7d55122cf450f10b5af74cfb4ce82ae4fc6fb7dd414c2469
- MD5 c7056a1f92245eec9e5ca71f406c4811
- SHA1 dfd0cf087771943aa92e7e88114e993234425d8b
- SHA512 640987725389f98a39892bdb03dbb59f316227b6611c488665f2d166bd8434b34b86ad1d784c9b750e9d57b031ea1c1522be37822111683e2e8762213cfefa2c
- MD5 SHA1 SHA512
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  Combo Minecraft/Minecraft Checker/xNet.dll
- Size 104KB
- SHA256 6c7ec4cc31a2ce0b97703b7a42e3448e9b87d96dda12761ca24d8787ac27cff1
- MD5 158defd55a804aa8d4d67bfdf7a4af9c
- SHA1 9dd41914fa181cb5225e593373f7dca062d7af0b
- SHA512 e98062b3b035d7d87c3457621c5ffc0aefed490544739219c4f4cafc3e7de248f1cf91edb3564e49d406f9fcaf314838d33b2ddd7e3b1a1751e5819b9ab798d6
- SSDEEP 3072:0IALHSH7PhqKnUqnV+xnEdSCo5E/awN5lRd0YjJ0:07LyIqnV+xnEdEmf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  Combo Minecraft/SLAYER Leecher v0.5/._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
- Size 1.1MB
- SHA256 54ba0c1fb0e81fa1f796531ae506fd184dea10628ab9f35ab9066df86b43c3a6
- MD5 b6d2a0e9584d3f7ae696ac83fc94713e
- SHA1 46c8381de688107919d2658c996ee3d0a03fffae
- SHA512 53fa6d888a0dda49d4b62402f5f1086b52ae67e9d4e18a03eb5cb8ea0b107fc87dfec2f965dbde464c02f6bec48972860a1cdb78c9067e1d9d2e7adc4820c645
- SSDEEP 24576:XZ+IA3qv19gf0fMmwG800J2Gjfk22b4ZqqqqSqqqqqqLqq/qqAZl:J+IA3qvv60dZsk2
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
behavioral11 behavioral12
- Target
  Combo Minecraft/SLAYER Leecher v0.5/SLAYER Leecher v0.5 By X-SLAYER.exe
- Size 1.8MB
- SHA256 3eba607f97a148578a200cde9631e1524c05ce6e25bf6ab6cb4aef818fd08037
- MD5 9541fbd3065b66523a64971c06985124
- SHA1 ca38cd7eb3b90b1a6acf9eb6a85f8aae2044a0d3
- SHA512 11a6405277022f80b011063259f9e2fd4d68daad145fc3166e8c7383091472178e62a06bd5f77aa1583345b1ed9cb511484e28f27c8ab53dd0e0e7c27e91427f
- SSDEEP 24576:ZnsJ39LyjbJkQFMhmC+6GD9dZ+IA3qv19gf0fMmwG800J2Gjfk22b4ZqqqqSqqqq:ZnsHyjtk2MYC5GDt+IA3qvv60dZsk2s
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery macro persistence
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral13 behavioral14
- Target
  Combo Minecraft/SLAYER Leecher v0.5/SkinSoft.VisualStyler.dll
- Size 964KB
- SHA256 365ffde7df914840eb21c96f34c39912a4b031e3814b8e902b67acee6dff65a1
- MD5 2d84a619d4bd339f860cb48af0c9b6c8
- SHA1 05e520126ee1100c98263bfbd5a6ff0ce6ace4f7
- SHA512 bd0c5e8b018ae393a5f2b92b4a10b5b674ca466074d18b4f86b12cbe9a6a520a95323146cb8e5226b1698f14efcc63addf0df421677b7f5ba3c8d94dbcb511d0
- SSDEEP 12288:XxIFyaWHyXq7VBnpJnqRAjcHFNdotFYsFjrXhmEBFa:XxIFyaWHyXq7VBnpJnqRAwHsJm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  Combo Minecraft/SLAYER Leecher v0.5/xNet.dll
- Size 116KB
- SHA256 2ac175b4d44245ee8e7aee9cc36df86925ef903d8516f20a2c51d84e35f23da4
- MD5 3df8d87a482efad957d83819adb3020f
- SHA1 f5b710581355ac5d0de7a36446b93533232144db
- SHA512 da28c34a85a6530b1c558fa11b0e71e70710d719cd8ceaf81f954d1fe3927ec139bee6c5f3135425cc5220905240f1a31d831611c46d18f5d52600b607ea59a6
- SSDEEP 3072:NWl4rhAigbJ0c1qnV+xnEd44asVyrVfwN5lTCTh3n3F:NWvigbdqnV+xnEd4zsVyJb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Obfuscated with Agile.Net obfuscator

Checks computer location settings

Checks computer location settings

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious Office macro

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18