122900dc02a11158ffd7767146ba0d666d0fe84ea95ac4b89901bcd29bf05ade

Sharing

Copy URL

Twitter E-mail

General

Target

4466c3e0450c6e5f63a28a4ab93376fb_JaffaCakes118
Size

657KB
Sample

241014-117xcasfpp
MD5

4466c3e0450c6e5f63a28a4ab93376fb
SHA1

db0d84d2693ec587aecc0833d56fe32348b01342
SHA256

122900dc02a11158ffd7767146ba0d666d0fe84ea95ac4b89901bcd29bf05ade
SHA512

48522b842e5d426db36e402fa9217b9d6972c35e88bab44a6bc8d790495fe12c47bff05d71cc382468ac8c8910a3ff36bf1426841b510d7b8629423a357f9616
SSDEEP

12288:1c1Frki2G4GQTq4OaQQTYJ8eP4/L5uO7D3f5BNq4yajQTEJ8ePv/b5uO7aLvHPAc:1Ir2G4GQm4OaHYJ8eP4D5uOHBBw4yaq1

Score

7^/10

Malware Config

Targets

- Target
  
  4466c3e0450c6e5f63a28a4ab93376fb_JaffaCakes118
- Size
  
  657KB
- MD5
  
  4466c3e0450c6e5f63a28a4ab93376fb
- SHA1
  
  db0d84d2693ec587aecc0833d56fe32348b01342
- SHA256
  
  122900dc02a11158ffd7767146ba0d666d0fe84ea95ac4b89901bcd29bf05ade
- SHA512
  
  48522b842e5d426db36e402fa9217b9d6972c35e88bab44a6bc8d790495fe12c47bff05d71cc382468ac8c8910a3ff36bf1426841b510d7b8629423a357f9616
- SSDEEP
  
  12288:1c1Frki2G4GQTq4OaQQTYJ8eP4/L5uO7D3f5BNq4yajQTEJ8ePv/b5uO7aLvHPAc:1Ir2G4GQm4OaHYJ8eP4D5uOHBBw4yaq1
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release507chaction.js
- Size
  
  859B
- MD5
  
  7a9a248d243942d22a7f8f6c4b3c52d6
- SHA1
  
  b11be8730a1c9bf8063398c14a3925e014eaa9c5
- SHA256
  
  491f7c5d7b0cea8b06ba7322b379f75f6b1b6d8dce3c3071a4323017bc1382a5
- SHA512
  
  ce2b04d12008b0b5bcf64cc05744bdaa3b9629e9604a7a0f73833745f2ec96b692bafd20be3df4ddf4a34aacf7537409870f829361a19128d2c887e9719fffb1
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release507.js
- Size
  
  762B
- MD5
  
  b9eec5e626f0b498fd5f6bc5093e6da2
- SHA1
  
  9e4fd1bf669746bfaf4f40568e97829f707b572d
- SHA256
  
  1ba1c0bf76dd35edc6d7ae06768c19c2a575c44d4f46894533be884c4a625ab2
- SHA512
  
  67cb45d7dee92bdda1a9ec53872844489970b6af86c10405f54621651681f4db222cb33443be913e8ba65503c742107835eba9236b0ec950a70c282c45b57439
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release507ffaction.js
- Size
  
  698B
- MD5
  
  c3818f330f77d85cc8ee4649af8ecbc3
- SHA1
  
  bcbf0f5eafd7ca4b31a0370a1d3605abc5f43ea0
- SHA256
  
  49a87d881276663283dbec05e7366524cf109436f02c1c83e58cd1c089261d5a
- SHA512
  
  8f7fe03665cec2427f8602312d66886fa38854408a302cc9ac43a8577b105e4dcf5d272301aa3018b463c1160ce99e6c68ee1f2c6e76591af560a5d2337e511a
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release507.dll
- Size
  
  85KB
- MD5
  
  f6996c599f61a8b6e76e4f4f9f4a76ad
- SHA1
  
  991983774e3ae140dde35d84bf6c55aef90c61f2
- SHA256
  
  bf7a4b14e50121de2efe4494d0070615936cc79ddd3e8e67d064c357f7cdb961
- SHA512
  
  8197f457bd9fed50d965e65e189ca77386c64f7be5c7596893bfec13b96bc664a515a663212c02b66b52accaaed9a3f704fc14130fa07484438998329734b109
- SSDEEP
  
  1536:qkf9Csc+EE7Msd5N60GlVk8jkrwQ+nqLhPLlQq/sZNBZ:99++EEwsJ6FlVQ+nmaq/id
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  98794d099c42abd79c4ef7b523bc4401
- SHA1
  
  70e1db99438cf1bc51f058c719d5f0a5d0f84f17
- SHA256
  
  7fd569b7262d403558fe8ac4b7a960e3f27d0e854d7b066103c336870baefa63
- SHA512
  
  f49868fd1981288a36ff47e5f95613226490275e307ad940a7e28eaa83f8471cc7e54014b3e8280137df3251bf9b1f134fb6bc2184e59f759559cd7aa385d887
- SSDEEP
  
  6144:Ue34G3Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bm/:33q4OaQQTYJ8eP4/L5uO7D3f5B2
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16