5df91c2e623d57b3f0a4e6c24bd81c694dc0a8aed71caf86825573cda4f994aa

Sharing

Copy URL Twitter E-mail

General

Target

094deea140f73724b0b75f600d636b85_JaffaCakes118
Size

657KB
Sample

241002-g5396s1fnm
MD5

094deea140f73724b0b75f600d636b85
SHA1

2dbf95c0c77dfb6de7123ad0d02b86ed52ad6113
SHA256

5df91c2e623d57b3f0a4e6c24bd81c694dc0a8aed71caf86825573cda4f994aa
SHA512

211889fdc888e4451356fde4e31a8e534b7d8d1afe31f4530aa293194112a6c11447c4ad947f1355f91cba68e38b39516e75518388ea42a4b8c5a76a83dd60dd
SSDEEP

12288:ocfc2G4GQTq4OaQQTYJ8eP4/L5uO7D3f5Blq4GaFQTwJ8ePV/t5uO7ELvHhA2:oc1G4GQm4OaHYJ8eP4D5uOHBBo4Gacwi

Score

7^/10

Malware Config

Targets

- Target
  
  094deea140f73724b0b75f600d636b85_JaffaCakes118
- Size
  
  657KB
- MD5
  
  094deea140f73724b0b75f600d636b85
- SHA1
  
  2dbf95c0c77dfb6de7123ad0d02b86ed52ad6113
- SHA256
  
  5df91c2e623d57b3f0a4e6c24bd81c694dc0a8aed71caf86825573cda4f994aa
- SHA512
  
  211889fdc888e4451356fde4e31a8e534b7d8d1afe31f4530aa293194112a6c11447c4ad947f1355f91cba68e38b39516e75518388ea42a4b8c5a76a83dd60dd
- SSDEEP
  
  12288:ocfc2G4GQTq4OaQQTYJ8eP4/L5uO7D3f5Blq4GaFQTwJ8ePV/t5uO7ELvHhA2:oc1G4GQm4OaHYJ8eP4D5uOHBBo4Gacwi
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release140chaction.js
- Size
  
  859B
- MD5
  
  c257580c14b7f684963d5cd3466479fa
- SHA1
  
  536a243831a675551bc526dcb572252dd931fab3
- SHA256
  
  f7ffa02d7a901270a0a52247d0108ad1ceea53ca1f17aadc444563febf5db78e
- SHA512
  
  8712828ada0ad5cabc84fa7c87065f36b9887fdd411fce31daef08c593a207e4c7adfe25eda6d2fcfa0f8c03410c41198b37e72c982cd3d60ff3ab20e878311f
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release140.js
- Size
  
  762B
- MD5
  
  d76b0972de0a9aa849fd321ef8efb699
- SHA1
  
  f71c26aab28cdbce7dfa834797b51c25d289c9a2
- SHA256
  
  628ac1976e29338b7535001238f0b0d6641c14d0faf96628f73a87f839f3f302
- SHA512
  
  34efc4af18b0bafea882269bd4ad145e9cd18709aeab4cc23a5f28bf499bb46605f5dc5ce9c20e1c7cc77c490bf1e47ddc46ca9e3bce8f0e5dcbc1ad7db40de8
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release140ffaction.js
- Size
  
  698B
- MD5
  
  c3b2846f17b32fd582a3b8cded2b8166
- SHA1
  
  ddc467b3f06e564562281becc150e14c3ba3c6d5
- SHA256
  
  b2f67918a5351dd016efb35777be0053d067788fb4e8d22e23c2bed83f1d4eb0
- SHA512
  
  97a478ae563df5e521a0d8cb047d7ef6873ff3a9b62b39df292fc3cad20b3ed823750a3b4dd2a430008775b0a34d219ce443b77ff2aceccc98732822f1fa15c6
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release140.dll
- Size
  
  85KB
- MD5
  
  b426fd4208b1f0640a5df264eef02e60
- SHA1
  
  0b50e5669b76092d3690606b7781010196bb4f42
- SHA256
  
  9eb7cfe5b46be13421325b25b5447ff721ca2d3e48bb71dd5b1bcff008840a4d
- SHA512
  
  69f8c56676d60d3d8712079302ffc70eec5494547f6df49e449d55ffb798867f85e9cf2e65d89651051475458890e5b4c23e3252f6a2b0d9881456d5555dd3e8
- SSDEEP
  
  1536:9kf9Csc+EE7MsV5N60GlVk8jkrwg/nqLhPLlQzRWNBZ:O9++EEwsR6FlVg/nmazRWd
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  3ca4d997aed4276c4195cdb74ce485a3
- SHA1
  
  63626219b5f6cb45737096f398f566116d7ae780
- SHA256
  
  03135866c60c7854a0ab622c3b048d8f64de994ff2ec25edb1d7cb7944214320
- SHA512
  
  db0bb0cf8c71dc28dc00fc63bb8836814a9593a9562c86b5ef0b88d851dfba0b7406d63a6f23dafeff3294fbb54943b94b1b2c5f33a9e4057286cbf6788ca19d
- SSDEEP
  
  6144:Ue34HdRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bm6:2dq4OaQQTYJ8eP4/L5uO7D3f5BL
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16