d1d626b7690fef2026c44746436638bbb92286dc44d9e567d4856e39f98ec199

Sharing

Copy URL

Twitter E-mail

General

Target

0b19d143d72200959250ef3e041cbbc0_JaffaCakes118
Size

657KB
Sample

241002-rp618svbkc
MD5

0b19d143d72200959250ef3e041cbbc0
SHA1

40fac35109cb573b43230643b548da0e904bc9b1
SHA256

d1d626b7690fef2026c44746436638bbb92286dc44d9e567d4856e39f98ec199
SHA512

2021180654fc9e0569a2869a60c78b4d20170855d2f309d356164b0d35213a63cd3032199b436d2188d09beafe077853b1348f91edf85600bc3f50413145395d
SSDEEP

12288:OqZD+6G4GQTq4OaQQTYJ8eP4/L5uO7D3f5BJq4yajQTEJ8ePv/b5uO7aLvHPAx:OqZlG4GQm4OaHYJ8eP4D5uOHBBM4yaq0

Score

7^/10

Malware Config

Targets

- Target
  
  0b19d143d72200959250ef3e041cbbc0_JaffaCakes118
- Size
  
  657KB
- MD5
  
  0b19d143d72200959250ef3e041cbbc0
- SHA1
  
  40fac35109cb573b43230643b548da0e904bc9b1
- SHA256
  
  d1d626b7690fef2026c44746436638bbb92286dc44d9e567d4856e39f98ec199
- SHA512
  
  2021180654fc9e0569a2869a60c78b4d20170855d2f309d356164b0d35213a63cd3032199b436d2188d09beafe077853b1348f91edf85600bc3f50413145395d
- SSDEEP
  
  12288:OqZD+6G4GQTq4OaQQTYJ8eP4/L5uO7D3f5BJq4yajQTEJ8ePv/b5uO7aLvHPAx:OqZlG4GQm4OaHYJ8eP4D5uOHBBM4yaq0
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release568chaction.js
- Size
  
  859B
- MD5
  
  8f13e7cc4368552466a914b146e69987
- SHA1
  
  ceae8b731289c02e8745278aaa0146be0ea6b135
- SHA256
  
  e4ef72a0a0d59a862471ab84d595c36a0f9305f84d4c4bb6e85d6de6d76778b8
- SHA512
  
  ad4e328863d05a4ec062bc0af2ed8fd959a8f79bac73e08133f723987cb87d8d015cc14d46a53ee53468b6d14ef878315c13815feedf2d9c0a9d56f9fbdeece6
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release568.js
- Size
  
  762B
- MD5
  
  fac7116ba01330c44d0c52fcf778676d
- SHA1
  
  c95eca428fb918a0d861daf9a8d5c86f6e8afa87
- SHA256
  
  041cf75ae3a9c57f6a1287e834b98bdf44f30fe448d02e92cbf3fa77833f512b
- SHA512
  
  671eac170a407b35488e89287a2c2a10c2c66d823b45ec3fba6ed83e294275d02445b0eee61f7ffa42d58c5c25442db18d3b875d288e23608b49dcd9743483f1
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release568ffaction.js
- Size
  
  698B
- MD5
  
  763635b59baf04189cd83a0b9c797b85
- SHA1
  
  252b657117b38a6a9626d0bcfa016d20f529f6f5
- SHA256
  
  b4495bb6bf59f7e8fc897c0e4203cd0f04c3f4048d19a271eccb518db2c6a8b4
- SHA512
  
  37d1021916ebe5422b230d2b0712f58f1870f5e65787d034ee8953e593aa307dce61c47ddf3335a670cbf4c7db38f78d67fdf1aee85f6da49522bff9d704ca06
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release568.dll
- Size
  
  85KB
- MD5
  
  45bc4ca8f88b3c91acf8c12707dacb32
- SHA1
  
  fba5b5ec72b7f1036422a13029c09b6c418d1bbe
- SHA256
  
  12314622959a2fe63e6134d725de85c4b38673157960e564f6146459af6e6da9
- SHA512
  
  42a4723882c348642ea427614891de7d49f729ff464248d8973cd05712d5d11f604bc7dd08e9d08a1c77aedb74fc2a4603de993497c60424528eb874e51e720d
- SSDEEP
  
  1536:akf9Csc+EE7MsV5N60GlVk8jkrwZWnqLhPLlQE9zdBZ:N9++EEwsR6FlVZWnmaE9zt
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  821fc22cdaf2375414b7e18772f77783
- SHA1
  
  7634b7fa77265e219c4257518ce37c9865857cb7
- SHA256
  
  39d40b19ba63460e19054ea9d8880cd20a460220e21a15da7a872be8ec3acdb3
- SHA512
  
  c683ea761e6c7cd5ffeb75e4995885d2861f35622b93f0a5cebab1e5f7b892d9470d5e353c2b2882dbe1e8b7f0ca93a4391cadd80d2110569dee455bfa5d801b
- SSDEEP
  
  6144:Ue34dfRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmd:gfq4OaQQTYJ8eP4/L5uO7D3f5Bo
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16