f33c4b519bfc210ff3728c28f4d441e5d26809d9999d01e5cca0e40ac0ad3323

Sharing

Copy URL

Twitter E-mail

General

Target

54ecff781745f1f19ec3f73d8f7fe89d_JaffaCakes118
Size

657KB
Sample

241018-cpsraa1bqf
MD5

54ecff781745f1f19ec3f73d8f7fe89d
SHA1

9a70f5e502c7fef813247189f1947aba28958f8d
SHA256

f33c4b519bfc210ff3728c28f4d441e5d26809d9999d01e5cca0e40ac0ad3323
SHA512

4ba3ed41b09f37c6e98b04a8fb8f206c8f39ab81b48e917f01dae23aa3e155eed9ac4886b112792e3ffade203335ac2f14f94fa20a7528b4e0449df96060677c
SSDEEP

12288:IsgZQeUG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Baq4ma/QTkJ8ePJ/R5uO7nU26lBP:Isg4G4GQm4OaHYJ8eP4D5uOHBBv4maeD

Score

7^/10

Malware Config

Targets

- Target
  
  54ecff781745f1f19ec3f73d8f7fe89d_JaffaCakes118
- Size
  
  657KB
- MD5
  
  54ecff781745f1f19ec3f73d8f7fe89d
- SHA1
  
  9a70f5e502c7fef813247189f1947aba28958f8d
- SHA256
  
  f33c4b519bfc210ff3728c28f4d441e5d26809d9999d01e5cca0e40ac0ad3323
- SHA512
  
  4ba3ed41b09f37c6e98b04a8fb8f206c8f39ab81b48e917f01dae23aa3e155eed9ac4886b112792e3ffade203335ac2f14f94fa20a7528b4e0449df96060677c
- SSDEEP
  
  12288:IsgZQeUG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Baq4ma/QTkJ8ePJ/R5uO7nU26lBP:Isg4G4GQm4OaHYJ8eP4D5uOHBBv4maeD
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release5759chaction.js
- Size
  
  864B
- MD5
  
  560dc3d01cb5181f5b42137713f2123a
- SHA1
  
  fcc3ca29e5c425f221d982d37f5af9d5a6aab2d3
- SHA256
  
  22c5c7fc9c4b9b2e75e83f8a8681b66b18c9f0b8e0fe753cdfa0cfc8418df363
- SHA512
  
  ccb0cd288970e425ed9ae80a88cd962cddddd422bfa741868dd15e30ee9d151ce4fdcf2684573928a69a0309a65fbf65d8714d53f4b550c51edf979b4e3c4d26
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release5759.js
- Size
  
  765B
- MD5
  
  c99a4cbf59b1bf5889f2eb0fe7267e94
- SHA1
  
  800edec11273e94a556f2a47c8c3c4d8f2c98900
- SHA256
  
  4a52532bda14110fe6f2cc9079295576e825515e843dbd6e44e2556a5fc1de78
- SHA512
  
  e10de31d0ffb4df71be647ce971a7aa668d555382ec00e3aba92fa0de37f8e4815c1e285e28028ee50a0180f4bcbe218f852ca9fc56be876ec79370a8d486349
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release5759ffaction.js
- Size
  
  702B
- MD5
  
  3bacc9663a2322b7b1d6e83ec8492ded
- SHA1
  
  923febdc718e79a261c94c4f3fc6eb8addf97d1a
- SHA256
  
  ed4ea1974918ebf190cbdfac736a5170608af20ea6e403669009ddd32a2e3b07
- SHA512
  
  2b7b3e5d707ab7dbda305490f9c860dd46775a6ad78499fe474437e7976874222b1472c3aae190fc5ea9880c2dc440fc0e49dbff018dc429115d9ee214c29a83
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release5759.dll
- Size
  
  85KB
- MD5
  
  0f91b9e1da6ca5cce27b72fb36bc97cc
- SHA1
  
  34cc371d12330ed9342142398e70e36fd4b7df33
- SHA256
  
  690a2659dc9ec162d01fcb787a646c2f2a390b18693868456ecca889bff2eabf
- SHA512
  
  bb8b7730f0be6bd08b3d397bc6e30eafbc664a841d438e242e91aee723925b6025de9eb1ace709d7fd51744c1d8d879d172c5048cd33a09f679e1be875d4e23d
- SSDEEP
  
  1536:KhMWCsgyMIwP/t6hp1ZcTkrCZzCTfLlQHjR6S:HWKyMIwP16hp1KzgaHjRn
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  9dbd5e5d014fcb8f602d66ab5e65abf9
- SHA1
  
  311088a56e52797a821fdedf096568a3657e920a
- SHA256
  
  a23e67250ed0a441c4ce84460e905538650e4bb95ebe5b5120adfe5932e4cacb
- SHA512
  
  e9072f0ea27536850273a4d01b966cf8118669cb78825bea61896e8100e8c240b635209912d8a666ccdd83f24bcef196e5a357a53e3f8a620c333f030195c3c5
- SSDEEP
  
  6144:Ue3433Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmo:u3q4OaQQTYJ8eP4/L5uO7D3f5Bh
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16