a3a348797b08856296f9f96a9c9414b83bea3fa31680262fb979c9e64be6e6b9

Sharing

Copy URL Twitter E-mail

General

Target

0066eee95811dfb2a98b3f064a63571e_JaffaCakes118
Size

657KB
Sample

240930-kftwzszdpf
MD5

0066eee95811dfb2a98b3f064a63571e
SHA1

75d2c1b7b47556e0faa7ee9df676655a323313be
SHA256

a3a348797b08856296f9f96a9c9414b83bea3fa31680262fb979c9e64be6e6b9
SHA512

a7fabfea4d1787ae4b8b8f4846e51d4374c7614a325ce153782e669328b131ef70dda8c5ffbdfa54361d851b79708c36973e04161fcb3627014e0070b22bfbfb
SSDEEP

12288:0d9HSAG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BSq4ma/QTkJ8ePJ/R5uO7nU26lBA:0dBG4GQm4OaHYJ8eP4D5uOHBBH4maekB

Score

7^/10

Malware Config

Targets

- Target
  
  0066eee95811dfb2a98b3f064a63571e_JaffaCakes118
- Size
  
  657KB
- MD5
  
  0066eee95811dfb2a98b3f064a63571e
- SHA1
  
  75d2c1b7b47556e0faa7ee9df676655a323313be
- SHA256
  
  a3a348797b08856296f9f96a9c9414b83bea3fa31680262fb979c9e64be6e6b9
- SHA512
  
  a7fabfea4d1787ae4b8b8f4846e51d4374c7614a325ce153782e669328b131ef70dda8c5ffbdfa54361d851b79708c36973e04161fcb3627014e0070b22bfbfb
- SSDEEP
  
  12288:0d9HSAG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BSq4ma/QTkJ8ePJ/R5uO7nU26lBA:0dBG4GQm4OaHYJ8eP4D5uOHBBH4maekB
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release3199chaction.js
- Size
  
  864B
- MD5
  
  5fc41aa7d62f33bf9dcad127206239cc
- SHA1
  
  124ed8ea9b9dbedaaa90bec6123135ffd116fab4
- SHA256
  
  a5c12ae0e7d34358a59a180bebbf1b41ed9346b55a3e5c5f891f2dd7fe1bf28f
- SHA512
  
  60f5efe154cc3709d30bb9c0f9cc609cde139a1851f02a213fe280d28de70477a264f371f6894c14561bd5a6a2b3c973a7df38fbfff74912868312c17ce09b50
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release3199.js
- Size
  
  765B
- MD5
  
  e0fd4925c61bb95f3a5b45c88c30115c
- SHA1
  
  791fcb0099bdeefdcb85a1aeaeccf84f32448513
- SHA256
  
  d5e251ba868163e11e7f5a142d5b4bb86869d4f1ccf85026a7726f613d9bde4d
- SHA512
  
  a82fc85c9cb5077e44f771fd00958f165da5f22a583e6b00edc39b13189982fd554421ca52ecddefd589fbcc3fadff3345eb73df1ef1bfd3ca757acc8ed091af
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release3199ffaction.js
- Size
  
  702B
- MD5
  
  644d379ae78b10118ad0198f28b77ab7
- SHA1
  
  bbd17b507c41621b57feec3c5470340032d43575
- SHA256
  
  b10477d507a52cf91a7903c6231be9f1feabe3c3033bbb6ccae66c01b814dfb4
- SHA512
  
  b60fea5fe17c37911583376cc80423fd81e5bebf6de6e772a8a931223cb2df1f1fbb10c1fc216e5ecf1e35f975428aef9d753d82187e27ecbb9265cbcc5ba08e
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release3199.dll
- Size
  
  85KB
- MD5
  
  53dfc23a0f8338954ffb7cf5961e5640
- SHA1
  
  b71462556e494d7e57467d5cae72cc56991d194d
- SHA256
  
  7efaec85c18226c0e12f4d458b9ec351e48b38600ace8a5fe41a9aec33496b4a
- SHA512
  
  f7e791a4933c84c9e17eb8c2ee4743223955346a8ae82bfd507c5bb341f9e2dad80870020826ae7854dfaa468c577bbec48e175ef549000b6bcb130d3537aca3
- SSDEEP
  
  1536:BhMWCsgyMIwPPt6hp1ZcTkrCrF1CTfLlQCb3aS:oWKyMIwPl6hp1q1gaCb3H
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  932f3f4b7c597d04a9e5f514ebe74e61
- SHA1
  
  3720ad7f6a9d4ca7fb45b52f30968186c99e949a
- SHA256
  
  fc2fa933cbf0956965fc2e894093f5320c6cd0f06c75b282ec870bf42374d735
- SHA512
  
  50e6e9faa69b99a8c9471b4c4e69043acc6a96cd7d78ddbab392d117e45708129e92a0573d4e331d29fddd798582a9adaf59fc7a30224080c5967fae72865179
- SSDEEP
  
  6144:Ue34z7Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmO:i7q4OaQQTYJ8eP4/L5uO7D3f5Bz
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16