188f477448be44e6916d80d29af2671b0c943d5e5954b1f17b5c493703555f86

Sharing

Copy URL

Twitter E-mail

General

Target

30769708e13acbe91b6179c548f8db6d_JaffaCakes118
Size

657KB
Sample

241010-sa513awhmr
MD5

30769708e13acbe91b6179c548f8db6d
SHA1

ec2e2b0e1864ffd7142470b18e476c94f37236e1
SHA256

188f477448be44e6916d80d29af2671b0c943d5e5954b1f17b5c493703555f86
SHA512

84d06f0ed90b0fa0ce97ee72e2cb306b5f8808b2423d926f4734bb5a525829b07cdf4faa2627d9b6e658cf9916a2f1d6ffdbe70aef392ae482cdc6240cbf33fb
SSDEEP

12288:RwDnTG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BYq4Wa/QTKJ8eP9/75uO7eU266Bq:RaTG4GQm4OaHYJ8eP4D5uOHBBN4WaeKP

Score

7^/10

Malware Config

Targets

- Target
  
  30769708e13acbe91b6179c548f8db6d_JaffaCakes118
- Size
  
  657KB
- MD5
  
  30769708e13acbe91b6179c548f8db6d
- SHA1
  
  ec2e2b0e1864ffd7142470b18e476c94f37236e1
- SHA256
  
  188f477448be44e6916d80d29af2671b0c943d5e5954b1f17b5c493703555f86
- SHA512
  
  84d06f0ed90b0fa0ce97ee72e2cb306b5f8808b2423d926f4734bb5a525829b07cdf4faa2627d9b6e658cf9916a2f1d6ffdbe70aef392ae482cdc6240cbf33fb
- SSDEEP
  
  12288:RwDnTG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BYq4Wa/QTKJ8eP9/75uO7eU266Bq:RaTG4GQm4OaHYJ8eP4D5uOHBBN4WaeKP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release1015chaction.js
- Size
  
  864B
- MD5
  
  c61c38b95ad5e9a969deff16cc9d645b
- SHA1
  
  9df518ad40365bbe34b2040e4887e54cf121c302
- SHA256
  
  e0d4c90c229852d121725dca8ad003608b645bddf10abe462d1607b5aa5bd170
- SHA512
  
  a708947201d2e88d9a6b7cb68d75559be121cb112c46ef6b6e93a207023ebe06ea2678ab3bd0ca5e208e599e0c4648222786c7945f69e0987563bb9bceb6e6e6
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release1015.js
- Size
  
  765B
- MD5
  
  7e42658d2bf2914c3b637eea41231f40
- SHA1
  
  e82be63dfa10df923b35fc4d7076d52e739ed9d6
- SHA256
  
  3a0c7279af628d8b3e44d92368159e379034a4c41c69e7f0c8c540f48e3fd397
- SHA512
  
  7f4c0a8c79f95a68fc428e2e779402036b430fb7d858b8f18efa8140e02c1f2d50c4079da5b4fe6f0c81bf2ef0eed7654dad89b9d1b87a60b1809e9e63f4eedc
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release1015ffaction.js
- Size
  
  702B
- MD5
  
  190650546941b43d52e850dcb054beee
- SHA1
  
  691ce84d72908cb5bf72c15039178dbc2499d913
- SHA256
  
  6a7d265b35b87b6916d3959ee8fd94384143a9f0211e11be53dc79719d85cb0f
- SHA512
  
  eddfe2722e01f6332a4e74a96d15ebb7487d31bd0e34819a88158a6b9cc1c1eec87b527ce9bd5fcdc1af92139ac971e4730aa912da273d7da9b96f0c894a7ae0
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release1015.dll
- Size
  
  85KB
- MD5
  
  9dce9bc3dec208f03b8ac4efafe3d3af
- SHA1
  
  41e51efbef2a76bb3dad85a5cc9a9ac99cd134b6
- SHA256
  
  147f61c337e2e533d6bd858113179cfc0dbec26460852cfcb9eda4c78561c856
- SHA512
  
  1827771c7bb47abe7086437a4822dcdb83c106ea0dc6b0203d918072d6c04e42382dd15a609b029d3d1227e4e930ef97c0e42090eb656c23aa48060f4a4a2b91
- SSDEEP
  
  1536:NhMWCsgyMIwP/t6hp1ZcTkrC2yCTfLlQzlpKS:0WKyMIwP16hp1lygazlp3
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  c293ae1109b3bab8c2d5ac73ca795e8d
- SHA1
  
  f43bdfbc9bc7b1b0a7bde49acacd00820f23f445
- SHA256
  
  5572d3d98a62f4af6d9e0c34a006c980f7883a7f183f02c11a4a2a3b763269f7
- SHA512
  
  87b407e9bdc612d49671c0ad25fc09f0363e7d7dda5412a76ab01ab63cfd818555353e92ffac56cd69cc1baa0f8176e6a994a7ac7933b5fbd2019537aad353f0
- SSDEEP
  
  6144:Ue34ybRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmp:zbq4OaQQTYJ8eP4/L5uO7D3f5BM
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16