c5517bc09544eab54352f4fb8bd14a6f7a45035225791aa63e78e69e5a91c4b0

Sharing

Copy URL Twitter E-mail

General

Target

3710884685acedbfb2791596649c03e3_JaffaCakes118
Size

3.4MB
Sample

241011-15qtmaxake
MD5

3710884685acedbfb2791596649c03e3
SHA1

14c0269076f307105588cbeb38cc6fcd978309eb
SHA256

c5517bc09544eab54352f4fb8bd14a6f7a45035225791aa63e78e69e5a91c4b0
SHA512

69e4062d4615e8f47d74857a4f4f9e5397e0746c9fd5579da809ac976cb29311a4172a19ac82905a5752c99acdd6b2ea7fe121c38ea3fbde75d81c019e5d85f6
SSDEEP

98304:wHXd2IY9PhramTlVeTIKjBdllrEiUDH+o3sKGFJpJilv:KbePhtreTVrlrELr+3JW

Score

7^/10

Malware Config

Targets

- Target
  
  3710884685acedbfb2791596649c03e3_JaffaCakes118
- Size
  
  3.4MB
- MD5
  
  3710884685acedbfb2791596649c03e3
- SHA1
  
  14c0269076f307105588cbeb38cc6fcd978309eb
- SHA256
  
  c5517bc09544eab54352f4fb8bd14a6f7a45035225791aa63e78e69e5a91c4b0
- SHA512
  
  69e4062d4615e8f47d74857a4f4f9e5397e0746c9fd5579da809ac976cb29311a4172a19ac82905a5752c99acdd6b2ea7fe121c38ea3fbde75d81c019e5d85f6
- SSDEEP
  
  98304:wHXd2IY9PhramTlVeTIKjBdllrEiUDH+o3sKGFJpJilv:KbePhtreTVrlrELr+3JW
Score

7^/10

adware discovery persistence spyware stealer upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/Helper.dll
- Size
  
  1.2MB
- MD5
  
  7ee90ccf6869674fcf852557de88ea6d
- SHA1
  
  14ac643f0be8232bb99966df93fb0e1045a027f5
- SHA256
  
  c4e0adbc811be0450cb3cc3b08a4fe796a795ad5dfbfbf7d54da21431ef6d9ae
- SHA512
  
  9e37f76ac5b90be5f8b784c085154bd8752800fd21ad24975a6fd4ae04fe7307cab6616b4bb810e6bbf9c1ff42d60c077192340fc5eef17adc42d7b76709fb2d
- SSDEEP
  
  24576:HvDB0FvmnWRfRMhQw4rCdSdodiILLcC18isTq+D1MZ7:PqvmnWVRMhQn2SdZILLco8isTq+D1MZ7
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  14KB
- MD5
  
  254f13dfd61c5b7d2119eb2550491e1d
- SHA1
  
  5083f6804ee3475f3698ab9e68611b0128e22fd6
- SHA256
  
  fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
- SHA512
  
  fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
- SSDEEP
  
  192:t5ZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRYgsfA:fBo/680dCI5adOjFOg9//p27uNw2bo
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/Processes.dll
- Size
  
  35KB
- MD5
  
  2cfba79d485cf441c646dd40d82490fc
- SHA1
  
  83e51ac1115a50986ed456bd18729653018b9619
- SHA256
  
  86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7
- SHA512
  
  cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043
- SSDEEP
  
  768:uxEiycFoaj/+WSiJfmjvab7L/cUf7IIlMLRF:uxEm7sgfmjy//cgdlM/
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  ab73c0c2a23f913eabdc4cb24b75cbad
- SHA1
  
  6569d2863d54c88dcf57c843fc310f6d9571a41e
- SHA256
  
  3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
- SHA512
  
  99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
- SSDEEP
  
  96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/nsislog.dll
- Size
  
  42KB
- MD5
  
  e47100b70748fc790ffe6299cdf7ef2d
- SHA1
  
  ad2a9cd5f7c39121926b7c131816e7ba85aeead2
- SHA256
  
  271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144
- SHA512
  
  88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93
- SSDEEP
  
  768:wCpqFQLwm2VQRIsW6z66P9dmnKyAPKoaQtt34Zt4DtV4U0Kx8xkS:XpqFQiVUfDzXmmb6mJVN0KWxN
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/util_ex.dll
- Size
  
  776KB
- MD5
  
  f9886cee41d173d573dce2686b309c15
- SHA1
  
  8b602e3c02b171583e49e1a3d07dbdff30726ed5
- SHA256
  
  bbd2a02336e04559da1487bd5f5ac70c4e040a9f5b2a0a3fc94641aeaa4d8b81
- SHA512
  
  f370cbb5c0e9f004d27b4b9fd185a7e5bfbcdfebecd70e423159da559846e5ca341a376afc07dcdcb1ff241ca09574969f077ca372b4c2786fb1c8329feb587a
- SSDEEP
  
  12288:RnpNIoldAkQzJ9JePTgiqmKW8wYfkFHR7QcVGMp8c6Gh+CA1bGk45NdwvG:Rfg9Ur+Wuc54MJ4CKGkg
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/version.dll
- Size
  
  6KB
- MD5
  
  ebc5bb904cdac1c67ada3fa733229966
- SHA1
  
  3c6abfa0ddef7f3289f38326077a5041389b15d2
- SHA256
  
  3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
- SHA512
  
  fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
- SSDEEP
  
  96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  
  $_28_/updater.exe
- Size
  
  291KB
- MD5
  
  c4954b5c4b8f8293fe7cb0de9b9fe32d
- SHA1
  
  66f8f8e572eaf1265fb5990e12aaef5f652af110
- SHA256
  
  70cce0c7aff82607a7f8627511df904e87e6eeafe75fe6b83940eb67f2c923e0
- SHA512
  
  7c2b4ddc64b09cad45e6c669ed8bdbee672dc9642c043908ddf0b75364152a803dc8c6916065becad7901e582b2fb7c58a384cd1a7ef4b8a4c9aaa295487c8f0
- SSDEEP
  
  3072:MVRqJ9kQAmmHgEDFx7RdkUxDrim1c/swhm/8QA/R/H4/AjhNpzBDqIBOMeZr:MVootm2hhRFpri2Qsf/m5/Y/AFT1DWF
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral19 behavioral20
- Target
  
  $_29_/ChromeHelper/ChromeHelper.exe
- Size
  
  246KB
- MD5
  
  02cdc9b19b07980e401e8bd15c03a323
- SHA1
  
  e463c68911c99b7f68c114d006bf7880d507ef8c
- SHA256
  
  7c7aff9c6f226272905c66631ff97d9f68ba10a80ac89547b160c4b896450592
- SHA512
  
  df052429731287571d0c5476e06edecfb36acd599bdfa539e0df804eacf4cca22e819aa5fce2313455aef2b5630e25249cdad3f32cb008bce473680a4153384f
- SSDEEP
  
  3072:T1hDqIZLwlmnWN/68zIyrjSHoWT0Cp2kL93YabMtfxMKZ4b+Wry9n5XtQwnPM2bE:T11JZc3sZ1sD46/PQAEjP5DTF6Cv
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral21 behavioral22
- Target
  
  $_29_/FirefoxHelper/FirefoxHelper.exe
- Size
  
  246KB
- MD5
  
  02cdc9b19b07980e401e8bd15c03a323
- SHA1
  
  e463c68911c99b7f68c114d006bf7880d507ef8c
- SHA256
  
  7c7aff9c6f226272905c66631ff97d9f68ba10a80ac89547b160c4b896450592
- SHA512
  
  df052429731287571d0c5476e06edecfb36acd599bdfa539e0df804eacf4cca22e819aa5fce2313455aef2b5630e25249cdad3f32cb008bce473680a4153384f
- SSDEEP
  
  3072:T1hDqIZLwlmnWN/68zIyrjSHoWT0Cp2kL93YabMtfxMKZ4b+Wry9n5XtQwnPM2bE:T11JZc3sZ1sD46/PQAEjP5DTF6Cv
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral23 behavioral24
- Target
  
  $_29_/IeHelper/IeHelper.exe
- Size
  
  246KB
- MD5
  
  02cdc9b19b07980e401e8bd15c03a323
- SHA1
  
  e463c68911c99b7f68c114d006bf7880d507ef8c
- SHA256
  
  7c7aff9c6f226272905c66631ff97d9f68ba10a80ac89547b160c4b896450592
- SHA512
  
  df052429731287571d0c5476e06edecfb36acd599bdfa539e0df804eacf4cca22e819aa5fce2313455aef2b5630e25249cdad3f32cb008bce473680a4153384f
- SSDEEP
  
  3072:T1hDqIZLwlmnWN/68zIyrjSHoWT0Cp2kL93YabMtfxMKZ4b+Wry9n5XtQwnPM2bE:T11JZc3sZ1sD46/PQAEjP5DTF6Cv
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral25 behavioral26
- Target
  
  $_44_/chrome/content/main.js
- Size
  
  17KB
- MD5
  
  f1507805993f4700efd58a2c70513a1e
- SHA1
  
  648eba15b2c74a62bd37d2f5dc25102b67eed3fc
- SHA256
  
  ec3e12d9a8ab16eb7b478700a379e4b1369e29f2c5a94c7de12c7490d29dbeaf
- SHA512
  
  99ae9cf788af2b801b6286ff7eee7c367d6b7cd791c30271d594ca540e3caff283fea8e7f738561aaae2a30ad342acbb2a7999e4b694ee84a98b0425b8b0482e
- SSDEEP
  
  384:g7WfQ/Gx554L5UgUPLOfjHpuyq2o/n3/Hi9T7ToMp+7Z40CSP5zFS5iSJ+0WAQjU:KM5eLmgMLIpuyq2in3/HGrxp+7Z40CS2
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  announce.js
- Size
  
  383B
- MD5
  
  f9b22790fe47d80a214c192d1034f60e
- SHA1
  
  742a661cb82d28707b3e5ed297e3e3834dafb06a
- SHA256
  
  a2dd7e64813177f4c3cedaf4991a8f6b68577a3e56fe17a5e57ec24db69ef1ac
- SHA512
  
  d0e7fbfcf08545b022a8b5e6f2b426b327bb19faf76a4381affca1715714016a7942943eb6ecff877948336c22583b62066db4eb6d8c4dedc08de8718ad55303
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  background.html
- Size
  
  102B
- MD5
  
  217a46404343dbe25a34dd731d741b97
- SHA1
  
  48219413b2fafe169a052969d30a2eed43d9891a
- SHA256
  
  0247278570472603063097649aab0eef51160de0d3a02c101151e57ce39c39ad
- SHA512
  
  2ad67a5ca2ea0ee92ddd6a0f77b381170393b1cae091c1beb2a2b0f046d84fea2fe6edd4612fa260885a1cdfb0975e70d40161a9aa1e7036552e19a2f6fc35ab
Score

3^/10

discovery
behavioral31 behavioral32