fc02f799dea1b670c662c2d2b5b26359dd7e618293ca6fe86a4c6437b4d890b7

Sharing

Copy URL Twitter E-mail

General

Target

012620b1a51fa4a646568ce74296061d_JaffaCakes118
Size

5.3MB
Sample

240930-nxgvjaxgke
MD5

012620b1a51fa4a646568ce74296061d
SHA1

d03959143bc05aeaed634749a38ba7f628a8f05b
SHA256

fc02f799dea1b670c662c2d2b5b26359dd7e618293ca6fe86a4c6437b4d890b7
SHA512

0448d974459b50c7a995d2ab1749baea1faf4e2c770a91ab149cd6d88945503e5a83a47dcc581ca84adee9b0dd679a90e065a3078cf2dc129d5e84621dfe79e1
SSDEEP

98304:jFLVwayNPX8shuZTkvW7gtcZ4fEY21Br+ADeGA4B9B3dl5SR6JnhhtoY:hBwpNPXtmTSLcdDjDeGAOpb0whtX

Score

7^/10

Malware Config

Targets

- Target
  
  012620b1a51fa4a646568ce74296061d_JaffaCakes118
- Size
  
  5.3MB
- MD5
  
  012620b1a51fa4a646568ce74296061d
- SHA1
  
  d03959143bc05aeaed634749a38ba7f628a8f05b
- SHA256
  
  fc02f799dea1b670c662c2d2b5b26359dd7e618293ca6fe86a4c6437b4d890b7
- SHA512
  
  0448d974459b50c7a995d2ab1749baea1faf4e2c770a91ab149cd6d88945503e5a83a47dcc581ca84adee9b0dd679a90e065a3078cf2dc129d5e84621dfe79e1
- SSDEEP
  
  98304:jFLVwayNPX8shuZTkvW7gtcZ4fEY21Br+ADeGA4B9B3dl5SR6JnhhtoY:hBwpNPXtmTSLcdDjDeGAOpb0whtX
Score

7^/10

adware discovery persistence privilege_escalation spyware stealer upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  14KB
- MD5
  
  21010df9bc37daffcc0b5ae190381d85
- SHA1
  
  a8ba022aafc1233894db29e40e569dfc8b280eb9
- SHA256
  
  0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
- SHA512
  
  95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
- SSDEEP
  
  192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/WrapperUtils.dll
- Size
  
  69KB
- MD5
  
  2cb7f556341e254d282e7ec24a2c6164
- SHA1
  
  87053c1dae3d1c8f2a6b5909b30ffeb8ef085b8f
- SHA256
  
  def2632242ea5a7b30fd2808545ed81b1545aca18a0a517553db4f2dd1442d0c
- SHA512
  
  79cb47e48c09f39958ff944c64aad2a3ef5cdb02975b68b9dcb85712e1a24baf48f856a8859efe77b66c10e487535496c4618482e864819104fda86249b29ce3
- SSDEEP
  
  1536:hzbHgcmRxQxNjyVlrdV+FcaHC00tsWjcdcTdDu:TKhUvCscTdy
Score

3^/10

discovery
behavioral7 behavioral8