624766bd549273311a6792c4e52cc528bc58769541a60079e5a8717376335b94

Sharing

Copy URL

Twitter E-mail

General

Target

3c97d5d9c08de6c79d88c49d86014317_JaffaCakes118
Size

657KB
Sample

241012-3f6vna1gkn
MD5

3c97d5d9c08de6c79d88c49d86014317
SHA1

a5225330cc442bc4316816d6e9205aac672fe21e
SHA256

624766bd549273311a6792c4e52cc528bc58769541a60079e5a8717376335b94
SHA512

decb6e8275b56818a935a276808615576daf6bebe09b21702b7b0e3a7be8b7ba043a5cfd17c1b34c995715d1e6e89d0e1e253b0a1ee439dee4a0858b7ce5f2ee
SSDEEP

12288:Kx0jG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BLq48aLQTkJ8ePv/r5uO7vU26ZIB:KCG4GQm4OaHYJ8eP4D5uOHBBe48aykJr

Score

7^/10

Malware Config

Targets

- Target
  
  3c97d5d9c08de6c79d88c49d86014317_JaffaCakes118
- Size
  
  657KB
- MD5
  
  3c97d5d9c08de6c79d88c49d86014317
- SHA1
  
  a5225330cc442bc4316816d6e9205aac672fe21e
- SHA256
  
  624766bd549273311a6792c4e52cc528bc58769541a60079e5a8717376335b94
- SHA512
  
  decb6e8275b56818a935a276808615576daf6bebe09b21702b7b0e3a7be8b7ba043a5cfd17c1b34c995715d1e6e89d0e1e253b0a1ee439dee4a0858b7ce5f2ee
- SSDEEP
  
  12288:Kx0jG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BLq48aLQTkJ8ePv/r5uO7vU26ZIB:KCG4GQm4OaHYJ8eP4D5uOHBBe48aykJr
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release1335chaction.js
- Size
  
  864B
- MD5
  
  77c2286295f4ecb27eb688410b614039
- SHA1
  
  c8d0d0fb21af6e970ae5a442f43c62cdcd238dc4
- SHA256
  
  2985a8264e657354f33120588df5cc3921e60a2fcb229b755953c6b9573cceb1
- SHA512
  
  77d602111b5876645ea04aac5f0d62ac328a74599ba1916b87158657aecf79d149cb03b2af62b5ca431a036632ec321526001379b5af5a11fe611891c8268c90
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release1335.js
- Size
  
  765B
- MD5
  
  7dc4fee188ca7d20d2b691262e14b174
- SHA1
  
  84335cc91e1fba8ea44b95bdab73e297e1bc1342
- SHA256
  
  f66be74e1b7e1a9b2a18d36978fa05885ccb3e930fcdd365c1abc2fbe5af0f61
- SHA512
  
  9ccfe3a7bfadd363db7397f06e9f4a4b1b2c0ac8294f24798d5652dac2c66162d9b5869fb7dd371771dab6cb83eb083c0e9aa9d0476a20755e6ab83dfd68ce8f
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release1335ffaction.js
- Size
  
  702B
- MD5
  
  f58f050a5fdd47218221a10f83eb515a
- SHA1
  
  82249b6794135321626e1389efdd434dd01b9b72
- SHA256
  
  45c16daf195ad11c8b926fe70c102d2736604fdb7ea4f9281d31f3be4b6c8054
- SHA512
  
  7016b2182e484c644cd0d0eaf412f7516a35f2db98edeed670aa424da67a61b43a4c1d4db0b9290cea360d63dd08602b0203034506219119544114afc945fbd2
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release1335.dll
- Size
  
  85KB
- MD5
  
  085808c01ae02dd2bb21fe9cd10314d4
- SHA1
  
  c7bf5d0fa63c96b423c186b0802283eaa84ad358
- SHA256
  
  41f3a93293ca7a40249c25c8afc46b0d3e8c644d8bddfea9506f3d035cf6c9fe
- SHA512
  
  823506c32ed35df5a9d122f75f517c1e1e20f164a52a626602f885e857077dd27eb4baf1f91be7aca0faa4f4612d093a0a8c706756198943966d44dbadfec2dc
- SSDEEP
  
  1536:FhMWCsgyMIwP/t6hp1ZcTkrCZACTfLlQh36iaS:cWKyMIwP16hp1uAgah36iH
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  a8ac60d597686cf376646865bc883add
- SHA1
  
  1d73952e2a6a0b29676e765279dda476014881b3
- SHA256
  
  e436bbf5d9fc9b3ddd77091c96beebd4cdff47fe49f05b6e969065bb94963a13
- SHA512
  
  5988d6b7eadd167cef93f7439b1e88fa3094fc9c2930dbc0d31a3d54358c8fae97edb9467264fb4f0cc7ec43bdb19adb5900f403543b398f28d8961162753aab
- SSDEEP
  
  6144:Ue345qRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bm7:sqq4OaQQTYJ8eP4/L5uO7D3f5Bu
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16