ec1693018b38ac8f2be71eaea9cbdb6bcb8911de5e56f9f69d8e06f1fec995f4

Sharing

Copy URL

Twitter E-mail

General

Target

ebbbc2403206de2fc892271dba0641fe_JaffaCakes118
Size

2.0MB
Sample

240919-tygh2syerq
MD5

ebbbc2403206de2fc892271dba0641fe
SHA1

d335f95d636ed759d4a9d8a1b7570ecff968b2d2
SHA256

ec1693018b38ac8f2be71eaea9cbdb6bcb8911de5e56f9f69d8e06f1fec995f4
SHA512

d2f114248b41fe47e9ad566ed2b27d85fc847d96cae99e4325ab608e07169e030693219efa50a2f28acc1057ebab7df17ecad13c4a4dc3aa0f9b10903e8839c0
SSDEEP

49152:3iENZarUIYfG+No0My5Uc8o79tTAzHHK/:SEwmJoLM0oRtTGHq

Score

7^/10

Malware Config

Targets

- Target
  
  ebbbc2403206de2fc892271dba0641fe_JaffaCakes118
- Size
  
  2.0MB
- MD5
  
  ebbbc2403206de2fc892271dba0641fe
- SHA1
  
  d335f95d636ed759d4a9d8a1b7570ecff968b2d2
- SHA256
  
  ec1693018b38ac8f2be71eaea9cbdb6bcb8911de5e56f9f69d8e06f1fec995f4
- SHA512
  
  d2f114248b41fe47e9ad566ed2b27d85fc847d96cae99e4325ab608e07169e030693219efa50a2f28acc1057ebab7df17ecad13c4a4dc3aa0f9b10903e8839c0
- SSDEEP
  
  49152:3iENZarUIYfG+No0My5Uc8o79tTAzHHK/:SEwmJoLM0oRtTGHq
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  13KB
- MD5
  
  07841403d5371183c4eaa5cab50663fb
- SHA1
  
  b0cee6e01502fdd2ee775922051333d626c63906
- SHA256
  
  3a18cf504265ab2267e1545106217767877fa9db6e2b5dd0a3a761dead33a99b
- SHA512
  
  436c1932d4ff56a11673beac5416ac0f2c7e90e5b993b3b8c8f589069d655da40c3ed514b99291ddf06aad66b0a634896daac19adf459ff791dccf3234af0e05
- SSDEEP
  
  192:sQNEcPshjd/dVaWnYPSZWrR6CM6CjVWsqCDLjJO/FEg98ZH:sQvshxFVaeYPoWH0VWsqCHQ/FEg9w
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/inetc.dll
- Size
  
  20KB
- MD5
  
  4c01fdfd2b57b32046b3b3635a4f4df8
- SHA1
  
  e0af8e418cbe2b2783b5de93279a3b5dcb73490e
- SHA256
  
  b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014
- SHA512
  
  cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2
- SSDEEP
  
  384:rJBJ8VnX8K+uKn2WQJdxbs3aEUhU7ya4L60Ac9khYLMkIX0+GwNyEAG:3J8+K+uK2WQJdxbsqEUhUua4L6AG
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  KRyLack_Software_Website.url
- Size
  
  48B
- MD5
  
  6f536747faf70a97c0906bae19c99586
- SHA1
  
  51738b6372bcc1e51d9d938205b755a0f0db88b4
- SHA256
  
  193019f7cbe31c7651bd95e785f17f523e3fcc3eb3ae219f464360705fffc40f
- SHA512
  
  ada7de72385c4faaa33e3f4b0c274a3a1d5e5f8d20e4672be5778333fe2d688daa3b67c84116cc6e9a3b5ee5924291e2e8b4dbd2364174f0168dad446b5ef5a6
Score

6^/10

discovery evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral11 behavioral12
- Target
  
  Ultimate_Keylogger_Website.url
- Size
  
  132B
- MD5
  
  76f1ddee8ae847b297941a688486ebb0
- SHA1
  
  145413fa01f796275611551d15ab2803ff7d6b88
- SHA256
  
  2a8bbee6fbc163df3af5db730b16c396b14701cc03a9d4cf1d753779cb3b6957
- SHA512
  
  40af75c1d3bd253acc1a6150ee1aa84f554fe9549eaabb8fb29494e4f3ce34efe6bf44a0a67f7483635b1e4817aaddf29eab91e9ce45e917ed7d205def3e31b3
Score

6^/10

discovery evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral13 behavioral14
- Target
  
  ulklfemon.dll
- Size
  
  1.6MB
- MD5
  
  dce63b5e778986d29ef048bf5aa41d1e
- SHA1
  
  4c47c7b90a92517409a61182a5c40dfcd6ef6e45
- SHA256
  
  14e27609a79e4eeb5b05ecde6c771494f5a60906b3bafca58a4010a57bf224a4
- SHA512
  
  8613250ca547184fc6fe41511d1ae57930474e6010b12c647d8f07b6fc49a6d682d77d6623ee8551beb587cb0b15d2ad347b6304ea4b63570fe1811d98156732
- SSDEEP
  
  49152:gTAX8MHHVliDGqMC5azzlbSp9HRJaVZTOEk6V4caaRYYL:HXd10DGqMC5azhbS3xJaVZa0VLaaRYY
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  ultimatekeyloggerfree.chm
- Size
  
  131KB
- MD5
  
  5d1a3618022abf1cffc2ea7f32ac9016
- SHA1
  
  8ba3c25ea66b038ce44721d77d7d56179e551a27
- SHA256
  
  5a80207d29367739b9f465ea37da4af8b15eaf0582921a595b713234f5c87ae9
- SHA512
  
  ba6a19b97374e08b83ea576007ab6aa3d5c0dbf66118ce7fa9977951525d9026df87e0946143babc3dfd252cba74112de32b2908b22a7f6d1c578f7c5f8c5251
- SSDEEP
  
  3072:XaIyyMuIwsjNTMrHuIqZSVvZ4HJO0VBpmz7XdfSRhaS4mcG:XCyMlpTfIqZSxZ+7VAl1HG
Score

1^/10
behavioral17 behavioral18
- Target
  
  ultimatekeyloggerfree.exe
- Size
  
  1.2MB
- MD5
  
  ae9d3886eed492eac3388ce0b64e9e7c
- SHA1
  
  3f040afccabf5a3cfb033f0b058d1ec1bba6d027
- SHA256
  
  eac3e306fef7caed9829705363fa762a5cc57b99a2cc87020f7375c44d5c3ea6
- SHA512
  
  484fde4cbde2abd645470c28bd4cc08eb5fbf5596043a9dd5830fceac01fe6a5c8d626d0af77d68815646ef74663edc35921cc9e079b7a4e0c9a079251ce6156
- SSDEEP
  
  24576:uYmEOHVqgKhEcHhWJavPFOmlYH0cY3vx5yC9JYwAtAnG1EQ5N14fubaWMUnX:TU1RKF6aHcOmcxN9JbIAnmnaWMUnX
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral19 behavioral20
- Target
  
  unukfree.exe
- Size
  
  104KB
- MD5
  
  36f2c316d28bb22b746cd26e3e66ea81
- SHA1
  
  74cb4e47caae20d2e192b028fc6e5147c6a6ab4d
- SHA256
  
  01d0b09052dadc41652ebde5ca5f1879860c4eaedb85a9b240397fbf9728ecca
- SHA512
  
  5a925756ef86a440291dd25700072346f5480b207ad138256036792aafe0351889d21ca883c7d0e6e9b6bd45a5887f3fa6d15e4cfea6665b1d38856102474fd3
- SSDEEP
  
  1536:eQpQ5EP0ijnRTXJ+YRN6QcI0oMUgco9HoDunLSg5LP+R0WWcqFmKEEwBI3:eQIURTXJ+qLMUgUipWWcqkKEN2
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  13KB
- MD5
  
  07841403d5371183c4eaa5cab50663fb
- SHA1
  
  b0cee6e01502fdd2ee775922051333d626c63906
- SHA256
  
  3a18cf504265ab2267e1545106217767877fa9db6e2b5dd0a3a761dead33a99b
- SHA512
  
  436c1932d4ff56a11673beac5416ac0f2c7e90e5b993b3b8c8f589069d655da40c3ed514b99291ddf06aad66b0a634896daac19adf459ff791dccf3234af0e05
- SSDEEP
  
  192:sQNEcPshjd/dVaWnYPSZWrR6CM6CjVWsqCDLjJO/FEg98ZH:sQvshxFVaeYPoWH0VWsqCHQ/FEg9w
Score

3^/10

discovery
behavioral25 behavioral26

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks whether UAC is enabled

Checks whether UAC is enabled

Checks computer location settings

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26