bac01d1734d92ad8517ffbfd01607fedcb71d4c856314c32a812e0fbd5442c08

Sharing

Copy URL Twitter E-mail

General

Target
68e9fe3012a7661a0aafd255960c8262_JaffaCakes118
Size 634KB
Sample241022-e5t1dsxerd
SHA256 bac01d1734d92ad8517ffbfd01607fedcb71d4c856314c32a812e0fbd5442c08
MD5 68e9fe3012a7661a0aafd255960c8262
SHA1 912b6e5444a31bd30247364c3c2661d73bb34fbd
SHA512 e7f74b712b62cf1ba6976e9913c3856cedfdce7d29ac26992b21a55a8f0c89d05d04b14abdd3afd3f91a1a9eadf2d2e8887c92c9055dbaa96637b9cf044adaf2
SSDEEP 12288:FcGwKG4GjeZHkwuPikQ7lKH5p5H9x1UeZHkwuPivQjlKT5pRxqlfo:FcGwKG4GjeZEXi37l6Br1UeZEHiojl4b
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  68e9fe3012a7661a0aafd255960c8262_JaffaCakes118
- Size 634KB
- SHA256 bac01d1734d92ad8517ffbfd01607fedcb71d4c856314c32a812e0fbd5442c08
- MD5 68e9fe3012a7661a0aafd255960c8262
- SHA1 912b6e5444a31bd30247364c3c2661d73bb34fbd
- SHA512 e7f74b712b62cf1ba6976e9913c3856cedfdce7d29ac26992b21a55a8f0c89d05d04b14abdd3afd3f91a1a9eadf2d2e8887c92c9055dbaa96637b9cf044adaf2
- SSDEEP 12288:FcGwKG4GjeZHkwuPikQ7lKH5p5H9x1UeZHkwuPivQjlKT5pRxqlfo:FcGwKG4GjeZEXi37l6Br1UeZEHiojl4b
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ffMediaWatchV1home4772chaction.js
- Size 834B
- SHA256 de4f5266b5b4fc332cd6dca2447b5e305d0a464c3226384890f3f6970124467b
- MD5 c805e9982d15d941786c0ca0ae36df21
- SHA1 a85819d382ec8ea0c06714c0d9282a4c27ee0276
- SHA512 befe544cc1a8c45c32912583eb713c3353cc7f533bd58f0113a65c6a3942e66b83fbbb5d3847271f538c8d5a37159a915910226a4003ec22836a3c0033d2949f
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home4772.js
- Size 747B
- SHA256 5d74081ac0d3a40d8fc4be0d0abfced8e51613760e04f9296eada960d622b862
- MD5 d7ae6eba4a1e8c46c7bb134237ff190c
- SHA1 ccf85e3dd4b3da3c743900ef7167800b73db148b
- SHA512 7970915f20818ee1f6b113df30de41e732feeb3cbdb4727e7bc961b1ade22ecc0e068d2493736e28b79c7b2e7ef062459bd83d082fecd2aa60b7b1f7af889220
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home4772ffaction.js
- Size 678B
- SHA256 17bf0e15d0943c4ecf370a73459bec4c5b0d460e5844630ae136e346571bb907
- MD5 49fd70fa0d6397ad2fa33742994e9ad9
- SHA1 798d5506e7b0ffd042c7a74f9e510826b329f534
- SHA512 491f4a025701354e677fce1ac3eff23d27259aab85c50d82655913f146f7460051b9debe391f263af5a054acf84eb1c803b089cd0f6d67688557947972390239
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home4772.dll
- Size 85KB
- SHA256 4eadb9f9f6457bef1cd87d07bb2ee839484e79b4c89ac8987cf78bb0d13f8c81
- MD5 d871191491f201b489d6ba17cd5ea483
- SHA1 696b8075cddcc60ec0e5c9017a78628720d7e553
- SHA512 b68bef98efcdf1b1d121c3cfe9500e19f058f97873e1e84823798ec7e5c0872cf61b65b7416e4cf9ec4108c6f878a5d5d5f0eb8fa204a377a89f3c043d98e9d7
- SSDEEP 1536:u8/1CsEmka04RhRtahrOb8DkhWlHA9glQsDgR:512mka0ElahrO6lguasDg
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 4d706ac27d19384b05ec0d8d8a56864217fed26f44ef58043377f4f75dfa89aa
- MD5 60db9d2ebd720264d719d61323f0c5b2
- SHA1 b81a3fbb7138e48a501bbd5b421e4d9eb7facf6f
- SHA512 260731d1a796cc66423719051dd3aa32202004f83d3b047f2aecffdaa5e066bcfe0f3f5b4285ee6c3103ab0a47bc77c63e46f4a319e21fa0e54b8bc99c027e9e
- SSDEEP 6144:Ee34GtpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x16:/LeZHkwuPikQ7lKH5p5H9x16
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16