86d8fa398156d1ed19e22d123330b93c99bff52601be43b9a7ba84b132e11b27

Sharing

Copy URL Twitter E-mail

General

Target
8c49e6c10ba6e9e6bf59580e6067ce27_JaffaCakes118
Size 634KB
Sample241103-tedcaaxlav
SHA256 86d8fa398156d1ed19e22d123330b93c99bff52601be43b9a7ba84b132e11b27
MD5 8c49e6c10ba6e9e6bf59580e6067ce27
SHA1 52a94698ee450af8a2c59b63281d37b073b4fa64
SHA512 738d7df7d1dc6555e1b987f05de583a71c6ad5a2fc5ececb404e37b517fc1f4d1e645f5f825275064cf251d22ec7b41db062337c62967bdd3707196b75055ad5
SSDEEP 12288:DqPMx6gFG4GjeZHkwuPikQ7lKH5p5H9x18eZHkwuHi/QrlKd5pnxlMlfh:DqPKFG4GjeZEXi37l6Br18eZEfiYrleU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  8c49e6c10ba6e9e6bf59580e6067ce27_JaffaCakes118
- Size 634KB
- SHA256 86d8fa398156d1ed19e22d123330b93c99bff52601be43b9a7ba84b132e11b27
- MD5 8c49e6c10ba6e9e6bf59580e6067ce27
- SHA1 52a94698ee450af8a2c59b63281d37b073b4fa64
- SHA512 738d7df7d1dc6555e1b987f05de583a71c6ad5a2fc5ececb404e37b517fc1f4d1e645f5f825275064cf251d22ec7b41db062337c62967bdd3707196b75055ad5
- SSDEEP 12288:DqPMx6gFG4GjeZHkwuPikQ7lKH5p5H9x18eZHkwuHi/QrlKd5pnxlMlfh:DqPKFG4GjeZEXi37l6Br18eZEfiYrleU
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ffMediaWatchV1home526chaction.js
- Size 829B
- SHA256 390d872a60d53641bc469be252d2b4fe8951a8c113fe2062154601c216c132e3
- MD5 df1d97261c0285c9be62944cfa50cb6f
- SHA1 40178d8bb3794f45f5bae32ff6f61a93f29e3bf8
- SHA512 90973f1aa149137e5b00b003eede664c98a358645759fc704407c53e0f2b25c0008992c8f3c548cae7267e09d8f78765537a843d30b8a4c3ac896cda10c1c912
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home526.js
- Size 744B
- SHA256 79688be1f785499ab9661e5e90468295082f9bc47f5401fb8122522f2b2b4380
- MD5 775a26ca482a89f53eef403afc384a22
- SHA1 e6def5c66683ef7f58b8ce60ab3cb358cb5c8c4b
- SHA512 23b9b677561db0d9294baff37fb08de6e52425bc250873adf2565e73258d92ae0b25319fd348502b7923300182dc78cd03b8cb36c6405eca20089c589f78c249
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home526ffaction.js
- Size 674B
- SHA256 5fad064b05d877b2611f9474c620fd2fe5981b2c274ff4eb4587e63db25b0dd8
- MD5 ac5bda4e31d0d2594136253099a5eeb7
- SHA1 e5cf531ddc8df321864157fa8f48873a8b7a43e7
- SHA512 cd02e9089b3191983caa5aaa53fcfdfbca0f85e6ddb96e3cc16b5fc69cae346470bbdb663d914b52bb9ff75381d06ceadfc5135d64e2bc1a681fbca529a9248c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home526.dll
- Size 85KB
- SHA256 487bad8862ab1a342c4662ff9c1dde980e859598da00dae4b1a53b974210231b
- MD5 19f210bab94e09b6d33ee98708528ac5
- SHA1 0dd2c0a7ddc643675700f3c2aab5b164cfde99e1
- SHA512 2b2468db499b97c0995304526d25941b8b07f8e5ac6b3f537c6da3681673f10d2034895c395ff4e67bc7bcf6a48fa281efaf502b5cea4d9042b44fdfef335c29
- SSDEEP 1536:Un/1CsEmkaMAvtahrOb8DktW9HA9glQ698J1:w12mkaMAlahrOW9gua69M
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 97bed99c85570ab749f7938e5e64d767ca026e82db5f19afe237119b792cd041
- MD5 1d4795e42cc45d4dc41be3000a097308
- SHA1 d85affafbf8391bc3f363ee05a22806a27cb8f0f
- SHA512 6acf62c6ed8d99392d168cdcbac3d92f6e01c78b253e7f688f8de190be01cbc2ce2e2852ab59533777fcae57129219714c94f727ba7dee9d3d83a7b19e70e487
- SSDEEP 6144:Ee34UdpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1N:hbeZHkwuPikQ7lKH5p5H9x1N
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16