b1fd0e9d75588f9c6bdc3adb67699d212c8bc21827553c0e91ef0a2a57fd353f

Sharing

Copy URL

Twitter E-mail

General

Target

b1a41a4692e653d3eda3a13218194f05_JaffaCakes118
Size

657KB
Sample

241129-q44nzsymfs
MD5

b1a41a4692e653d3eda3a13218194f05
SHA1

54e8d1af129e2f37cf7a36ae434688b5f9329a13
SHA256

b1fd0e9d75588f9c6bdc3adb67699d212c8bc21827553c0e91ef0a2a57fd353f
SHA512

b2610c8411f6853fac2a6cdca57fc769e5b0d72a4ef51a7127f60fbeaab361847c86d6841e780f6b9bcbd2f5b9f4ff5333ef43202e397f8c41165204243ea11c
SSDEEP

12288:PMj40yDG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bbq4GaFQTwJ8ePV/t5uO7ELvHhAY:P02DG4GQm4OaHYJ8eP4D5uOHBBu4GacJ

Score

7^/10

Malware Config

Targets

- Target
  
  b1a41a4692e653d3eda3a13218194f05_JaffaCakes118
- Size
  
  657KB
- MD5
  
  b1a41a4692e653d3eda3a13218194f05
- SHA1
  
  54e8d1af129e2f37cf7a36ae434688b5f9329a13
- SHA256
  
  b1fd0e9d75588f9c6bdc3adb67699d212c8bc21827553c0e91ef0a2a57fd353f
- SHA512
  
  b2610c8411f6853fac2a6cdca57fc769e5b0d72a4ef51a7127f60fbeaab361847c86d6841e780f6b9bcbd2f5b9f4ff5333ef43202e397f8c41165204243ea11c
- SSDEEP
  
  12288:PMj40yDG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bbq4GaFQTwJ8ePV/t5uO7ELvHhAY:P02DG4GQm4OaHYJ8eP4D5uOHBBu4GacJ
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  ffRichMediaViewV1release235chaction.js
- Size
  
  859B
- MD5
  
  bb35b2580d7f991076ab6bd741586c6c
- SHA1
  
  6d8cfc74af7958f4d3e3b8fbc44943dcc06e8198
- SHA256
  
  94049bbe9ef4c28815bb20c79595cd5312d09f30447acbf5b22686e65227ead6
- SHA512
  
  6600b9a980b59ddbb9786eb17e7014a56481e9d49193fa8547632248f43161578ba8732b831cff89072b5350c90add652be2d8d80929515deb107ea1c0ba8151
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  ff/chrome/content/ffRichMediaViewV1release235.js
- Size
  
  762B
- MD5
  
  b0613ee6dd3716be5b738b056eb68fb3
- SHA1
  
  0ff8a45c0b288f997b50cee9053df1b800688507
- SHA256
  
  f0477069e9ec3be54ee2789d76357dd097d99a7ff8dbb1692f38ae14c638e002
- SHA512
  
  13c3ae60c902d031340792312252f12d87415cc7b7958ec3a0afe57a2b2cba50a43aee75ddd4252437ba7afa270503eee45b6e514c01f36be214cd16931895ff
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  ff/chrome/content/ffRichMediaViewV1release235ffaction.js
- Size
  
  698B
- MD5
  
  83ffa5f865a92699b9cbd5e293b8087f
- SHA1
  
  a29d0f42da195d8c7723aaa123f49770f2227814
- SHA256
  
  dea51f432e853ed4ea50243cad779c0d85bfc2401b8a8c4739b06f85ab021b6f
- SHA512
  
  3ea925cec79c3d03d9e40c9c383caca0ba465e4e412f4a196ef9a925199e5a981ee1548fc25c39e41fed1ed9e3e5200a524de9fa2356beeb25fe5f16d80abf4f
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  ie/RichMediaViewV1release235.dll
- Size
  
  85KB
- MD5
  
  69e8031c107b6575ca910f3c8941493d
- SHA1
  
  93a0f83e5f2603d90866c2ffdd23a12bd6edb66e
- SHA256
  
  82122e33763b17118a49305e185b3aad91d6e2f4fbe149817400f341a1c5153e
- SHA512
  
  3ca4591a33c8a3886ab266d2877fc36d034da036570a4038763f5a0b117acb1cdeabc8f9955c949a4ca6f08c6eb072f235c4dad3398a3211a8c909ad01cd736a
- SSDEEP
  
  1536:kkf9Csc+EE7Msd5N60GlVk8jkrw1fnqLhPLlQ/jFtBZ:n9++EEwsJ6FlV1fnma/jF9
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  
  uninstall.exe
- Size
  
  289KB
- MD5
  
  f3ba0317b5aa56574ed8f6c776b31367
- SHA1
  
  7d4adf56931e75db6e23312df1978d450d247840
- SHA256
  
  0c7f513acd9a120065b1e3ea28ed1d3cb5a0b00832b88e5c79effb892857edab
- SHA512
  
  8c110cfb2dd03d6bdeaa38de69e8c7de2d4f354cead15c74072877b6ed9ff680a29b4ec7a089cf798eb2f0821de68eac0800ba7a273c7f9e84d0983708d0b043
- SSDEEP
  
  6144:Ue34ADRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bm8:tDq4OaQQTYJ8eP4/L5uO7D3f5BF
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/aminsis.dll
- Size
  
  567KB
- MD5
  
  450753ad96785a240a39deccab3af0d0
- SHA1
  
  21c544064d2ffa6444508268ce258a330d459fc5
- SHA256
  
  1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
- SHA512
  
  c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
- SSDEEP
  
  12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
Score

3^/10

discovery
behavioral15 behavioral16