jigsaw | 892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90fc6ae0

General

Target

ipscan-3.9.1-setup.exe
Size

17.6MB
Sample

240908-tt8rqsyalf
MD5

e9fda12cfcceffd2e6a19c39dcb01b1e
SHA1

ae007dba80a0fc03e44a22db3f4e53ed854b4b38
SHA256

892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90fc6ae0
SHA512

93cba11d265414ae99635c974ac5edb6acda22cc13d3f71474f887230b0e32c4c87035db1822c27fb500d5b83c27c2c2deddfd789208457e8618aca15c914285
SSDEEP

393216:HoWnc4nxmXzdw6ikbYvVZwaSrQ3tINEUWfFxr/WMUT4eR:HoWdnxudJbY7Tl3tICrWMUMeR

Score

10^/10

Malware Config

Targets

- Target
  
  ipscan-3.9.1-setup.exe
- Size
  
  17.6MB
- MD5
  
  e9fda12cfcceffd2e6a19c39dcb01b1e
- SHA1
  
  ae007dba80a0fc03e44a22db3f4e53ed854b4b38
- SHA256
  
  892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90fc6ae0
- SHA512
  
  93cba11d265414ae99635c974ac5edb6acda22cc13d3f71474f887230b0e32c4c87035db1822c27fb500d5b83c27c2c2deddfd789208457e8618aca15c914285
- SSDEEP
  
  393216:HoWnc4nxmXzdw6ikbYvVZwaSrQ3tINEUWfFxr/WMUT4eR:HoWdnxudJbY7Tl3tICrWMUMeR
Score

10^/10

jigsaw discovery persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Renames multiple (1481) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral2
- Target
  
  $PLUGINSDIR/modern-header.bmp
- Size
  
  25KB
- MD5
  
  98a614ef17188b5a5f2f84fbfd72e0ca
- SHA1
  
  dfc6e8ee9dd4ab648935a1729e6711a2542c1c60
- SHA256
  
  86ae7b376b2f9fd38c0a80133252aa4b6773eb487ec3e6261c45dbd5ee0e102a
- SHA512
  
  586c382a1b6b10122093c2e8bb8815b133ccf3ec19b9512bcf7e7dff02ba07d4430fed552d3f94d508dfb8ef174b72ac97d21961b744e40b543b04a5ce74f037
- SSDEEP
  
  768:fPYs/a/Y/eGSIEYVv5x9YYeyoYxeu/dYf4S00YEeSvdY3YBnYc1ezuY2YhDYoSh2:os/JGcVv6ZyAPVINe2xxVidjDmCU
Score

3^/10
behavioral3
- Target
  
  $PLUGINSDIR/modern-wizard.bmp
- Size
  
  150KB
- MD5
  
  571986bb6e3eed28c772e9dfa1b2d87e
- SHA1
  
  c2e7574f8713def6d8647a780d4b5d6fb54843a4
- SHA256
  
  8416e0209e7c1497ef84173f52b623eb38d86bab59886fe99317d8f557bf66f8
- SHA512
  
  2d2d5ec9e9627a0f7e3e3741bdfab4429cabffc0ab71c5968b87595d41be28ad29ae0dc5142710ad5718c6ef04cf76dee7a9b158d8b34c7a7d59eeaa7f66cf2a
- SSDEEP
  
  3072:yBbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxrxxxxxxxxxxxxxxxxxxy:Yxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4
Score

3^/10
behavioral4
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  6c3f8c94d0727894d706940a8a980543
- SHA1
  
  0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA256
  
  56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- SHA512
  
  2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP
  
  96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
Score

3^/10

discovery
behavioral5