b9a566002b18a06ab10adf3e5494d9531153d94ab0ab2a573e7ac003c9dbbe74

Sharing

Copy URL Twitter E-mail

General

Target

30fc88c5eb0340542731da12bd751697_JaffaCakes118
Size

657KB
Sample

241010-vlflnasapp
MD5

30fc88c5eb0340542731da12bd751697
SHA1

a1c49272ed46d0f31f660e0ed14b801d6b6a77b6
SHA256

b9a566002b18a06ab10adf3e5494d9531153d94ab0ab2a573e7ac003c9dbbe74
SHA512

c2d177b13e2ca1bee86877b711f6b327b3ea803c518cb51e445c3951d28325642a171667e088f3ff13998fa94f119e48d3e18bea41dc2e2836922703f90cd97c
SSDEEP

12288:I1KZUUhpFMYG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BAq4ca7QTgJ8ePN/P5uO7GLvh:IIZx+YG4GQm4OaHYJ8eP4D5uOHBBV4cl

Score

7^/10

Malware Config

Targets

- Target
  
  30fc88c5eb0340542731da12bd751697_JaffaCakes118
- Size
  
  657KB
- MD5
  
  30fc88c5eb0340542731da12bd751697
- SHA1
  
  a1c49272ed46d0f31f660e0ed14b801d6b6a77b6
- SHA256
  
  b9a566002b18a06ab10adf3e5494d9531153d94ab0ab2a573e7ac003c9dbbe74
- SHA512
  
  c2d177b13e2ca1bee86877b711f6b327b3ea803c518cb51e445c3951d28325642a171667e088f3ff13998fa94f119e48d3e18bea41dc2e2836922703f90cd97c
- SSDEEP
  
  12288:I1KZUUhpFMYG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BAq4ca7QTgJ8ePN/P5uO7GLvh:IIZx+YG4GQm4OaHYJ8eP4D5uOHBBV4cl
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release95chaction.js
- Size
  
  854B
- MD5
  
  a240b2e93c20172f490f66f7c83ae29d
- SHA1
  
  9aca8ae5ec32f306ea3923d2c38d1090c1c91a29
- SHA256
  
  4a4fb066f8915c1db29283d50621f614ec32a95890e29a791bd4a628f387c759
- SHA512
  
  92b155c594fb27f632eded8de1187ba2d0c8600edc09fb7ece781b8c42271f38213f882a6ab4c5c1eb2d64a7813e7da7c32453dffe53221fa88903bb5ccd6ddd
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release95.js
- Size
  
  759B
- MD5
  
  eec3d40225e2728f43fd884594065701
- SHA1
  
  3e7c3b56f0cb45251fda76158dab175e5b023d5f
- SHA256
  
  24e382002ee91d59080c6ae38382bc6e31860461cc019a7aaf570972da29defe
- SHA512
  
  e1fbe75b43ed01705971915f51676b7bf98ab6a1db8ac8374e062f4799a34a42e8fee82ba6924f3cd167e1fec8391d6bfb034eca3ef34237c63aa135199e5a54
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release95ffaction.js
- Size
  
  694B
- MD5
  
  1c60d04de1fd7cf786573d8cd440f201
- SHA1
  
  95d21d91a8372437d67a61b687857558398df584
- SHA256
  
  ecdf50bb4d233bb17877fde3a56e3e20af585b24bf0e0f8e5737eef923d37f63
- SHA512
  
  e4040fd010a69923c9011209b1ab0974b601bfee471d79bcddaa23dfa278434a598647f266c2c578d49fc61686eacecd5b55f1569a33edd60fe7f377866719a7
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release95.dll
- Size
  
  85KB
- MD5
  
  ebeec88ab9e1c315be6dfc3ce924b362
- SHA1
  
  a279a62d9146d576e7e82502874f6383135bb8b5
- SHA256
  
  e58f0d37f89322583cdea95a7ce9ab4c7386098c9d6edc48f976d107e01e4361
- SHA512
  
  23364ec961755e35c7126536ad7420962e53302925a15ad85ec00be6e6d74bfb62d4e13493c496d481e6cedf942074035034ddc0873db958d2dcb12f14978315
- SSDEEP
  
  1536:9c/9Cs8ekkcEDtqJ6Zk8DkPWNxnLlQNTb0pY:29eekkcEJqJ6ZPNxLaNTbH
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  122b0537a6ab8c158c2788d1625c281a
- SHA1
  
  646a95dfcd3c6020eebce5d8c5884b31f65aec1d
- SHA256
  
  d392a0d29127d990e85a716255623e12552bb4c3fdb66301f2f206e8c6a5d9c8
- SHA512
  
  88807df6053dc2a33b5a9dd533db55f773c2314e11c9036c6010e99186ca85a7dd2c2be72e46dae0fc385ed278e4a94420c0af9b528405b7302a0245652e6503
- SSDEEP
  
  6144:Ue34HFRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmg:WFq4OaQQTYJ8eP4/L5uO7D3f5BR
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16