0cc49cea4423f5d35e9297c3f24c0131924e19dd9dad425019fbc89349b2dd4c

Sharing

Copy URL

Twitter E-mail

General

Target

253c83103a7de1cb893f1aa63babc05a_JaffaCakes118
Size

689KB
Sample

241008-zlagvsvejk
MD5

253c83103a7de1cb893f1aa63babc05a
SHA1

2835a87d754489ed17ef7575dc0d06b91f38abcf
SHA256

0cc49cea4423f5d35e9297c3f24c0131924e19dd9dad425019fbc89349b2dd4c
SHA512

69f51f0a93e0a868fd3becc6c11a8a315174d1be9b160ab302abd3a42f27b29a45a9ee1d3137a519c6a01d3b4a737ececef20ac126c4b60431ddeebe09759178
SSDEEP

12288:l3LhOb5FG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDkjeKuV2v9b+N84LwwiHn6+:l3Ab/G4G37tUnvone83Z76bMHxgtU2v7

Score

7^/10

Malware Config

Targets

- Target
  
  253c83103a7de1cb893f1aa63babc05a_JaffaCakes118
- Size
  
  689KB
- MD5
  
  253c83103a7de1cb893f1aa63babc05a
- SHA1
  
  2835a87d754489ed17ef7575dc0d06b91f38abcf
- SHA256
  
  0cc49cea4423f5d35e9297c3f24c0131924e19dd9dad425019fbc89349b2dd4c
- SHA512
  
  69f51f0a93e0a868fd3becc6c11a8a315174d1be9b160ab302abd3a42f27b29a45a9ee1d3137a519c6a01d3b4a737ececef20ac126c4b60431ddeebe09759178
- SSDEEP
  
  12288:l3LhOb5FG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDkjeKuV2v9b+N84LwwiHn6+:l3Ab/G4G37tUnvone83Z76bMHxgtU2v7
Score

7^/10

adware discovery persistence privilege_escalation spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  f346047b13f37f79c462e59a6319faa1
- SHA1
  
  ce9e7cb9719000a69b463fe024c81229e322279f
- SHA256
  
  e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
- SHA512
  
  429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
- SSDEEP
  
  12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  ffTrustMediaViewerV1alpha3942chaction.js
- Size
  
  869B
- MD5
  
  fea1250df7fee3bdeab18e5b05c762a8
- SHA1
  
  f8c19ecad88565b06ac410e3cb05b4c772b58b0c
- SHA256
  
  b63b7a4ebba927570754b0bd2ed74dc781dfba90b9bb609415a97e1b99ea1954
- SHA512
  
  ff2ab6df360a5b86fee454a63dd5b54cdb43101f7aaa26c682e38ec2c50b12fb4fa1dbf19f410b7e57ba17f5fac12fd001621d73a9ba0362a806f73941f90080
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffTrustMediaViewerV1alpha3942.js
- Size
  
  768B
- MD5
  
  33c4f63bc9c240cc3d785e0135221680
- SHA1
  
  417eba06579b9c9dc07dfbb242acdb67870ba8e9
- SHA256
  
  f0d7c5dd71112da27a80e5ad31416080b3f44e91a7404e9847187f14703420c7
- SHA512
  
  0aa08375fc0acf37a9ee9bd113f1824410495eb089abeaba78c2e355ba000725a39d6999dd8f78b28ae6f3bed1ee83a0632a46c51f38debc446d5493d8446505
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ff/chrome/content/ffTrustMediaViewerV1alpha3942ffaction.js
- Size
  
  706B
- MD5
  
  103131c1f74b80a8e83a8e2b3ff473e1
- SHA1
  
  06c755d8876c5494524b7ba64ac07bf2fae11500
- SHA256
  
  b4bf7d15a35b5af67de9383aa73a13367d9103edb8cfb56e34f7dbc4a68362e9
- SHA512
  
  e9ab244e75ea3286e9694e6fed4c9b1d8085b3557920337bca3c75310f1f7b5814ec159d860503fb0b0da5d2ce6291b8b4f052680960d84ccc88a2eb3626944f
Score

3^/10

execution
behavioral11 behavioral12
- Target
  
  ie/TrustMediaViewerV1alpha3942.dll
- Size
  
  85KB
- MD5
  
  0a806bc88d53edb0241950de1cf2fcb6
- SHA1
  
  7a6fc8eaa08baec9dac414e0ccfbee1c2aeb84d4
- SHA256
  
  19e705fc235d849856dfc84ca85e0ed236f510c32686bc55c8b8e5998993d397
- SHA512
  
  669cbcdc339e7096669daa2f2f6a81f1ca7784c97d887337216864da8a3409fa57908de4392eff9f4e187d0386ac8747eaf755a9bd1b767b2a8832d8569893de
- SSDEEP
  
  1536:P5s2Sc4McEnVtKo+kNp8DkqZ518zOslQ0yyLv:u26McEnnKo+kNqZ5uzra0yyL
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral13 behavioral14
- Target
  
  ie/TrustMediaViewerV1alpha3942x64.dll
- Size
  
  100KB
- MD5
  
  ab98d1d0ebf62707bb27cc9ff6e71bb3
- SHA1
  
  ac4617b75c6f4f9cfe409bf507f8304d98de1946
- SHA256
  
  9fe0747b6aa6555793c9c05c932e92a70a9826fe00c359f121286c0887e0852a
- SHA512
  
  473a8b7b62b8ad64f7d67f86f371ffb2b5cd6b7091bb2fe1c694234b7225bc34abbf4db9030f2706f0557310125b4a08158604f0b89ae31002e0142e2d03b56d
- SSDEEP
  
  3072:YBjSnTZq1GSRzBHsQnTfGNAjaeSCPzQBTDzF9fL:YNSnTZq1GAlHdTONAjCRvf
Score

7^/10

adware persistence privilege_escalation stealer
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral15 behavioral16
- Target
  
  uninstall.exe
- Size
  
  295KB
- MD5
  
  32fc5a1bdb707d6c3293bacd90b20797
- SHA1
  
  26bd0f29816a323a4374121530b5cdaca338bd5d
- SHA256
  
  43ea3166b3b168bcc58861c172a21cd07711a0284a4927788cbe9053b594976c
- SHA512
  
  b4701e0717d0467bac45d05f2e36512f0f9436036a3e349c668bd5921ae86b151b5e5bd4624706fb5b30d865642db8ddf0f52dfffc94e8bb4e150cf88fea7d77
- SSDEEP
  
  6144:Ee34mojKTK0HVkUEYA2q5NbrWN83gQwwDuzMn6yDkvE39kojTxDtEw:vojeKuVnvon+N83LwwiAn6KkM33nxD1
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  f346047b13f37f79c462e59a6319faa1
- SHA1
  
  ce9e7cb9719000a69b463fe024c81229e322279f
- SHA256
  
  e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
- SHA512
  
  429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
- SSDEEP
  
  12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
Score

3^/10

discovery
behavioral21 behavioral22