Overview

overview

7

Static

static

3

bb98eac438...18.exe

windows7-x64

7

bb98eac438...18.exe

windows10-2004-x64

7

$PLUGINSDI...ad.dll

windows7-x64

3

$PLUGINSDI...ad.dll

windows10-2004-x64

3

$PLUGINSDI...st.dll

windows7-x64

3

$PLUGINSDI...st.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

options.html

windows7-x64

3

options.html

windows10-2004-x64

3

popup.html

windows7-x64

3

popup.html

windows10-2004-x64

3

profilinstylin.js

windows7-x64

3

profilinstylin.js

windows10-2004-x64

3

utils.html

windows7-x64

3

utils.html

windows10-2004-x64

3

interop.shdocvw.dll

windows7-x64

1

interop.shdocvw.dll

windows10-2004-x64

1

microsoft.mshtml.dll

windows7-x64

1

microsoft.mshtml.dll

windows10-2004-x64

1

profilinstylin.dll

windows7-x64

1

profilinstylin.dll

windows10-2004-x64

1

profilinst...ild.sh

ubuntu-18.04-amd64

6

profilinst...ild.sh

debian-9-armhf

3

profilinst...ild.sh

debian-9-mips

3

profilinst...ild.sh

debian-9-mipsel

3

profilinst...ild.sh

ubuntu-18.04-amd64

profilinst...ild.sh

debian-9-armhf

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb98eac43874f2f08babddfd2a879bae_JaffaCakes118

  • Size

    837KB

  • Sample

    241203-eef1vaymfs

  • MD5

    bb98eac43874f2f08babddfd2a879bae

  • SHA1

    b844a4ce25584e095057bb115084f6b2160794f6

  • SHA256

    71ed6fd674e384ddc915e47f5eac03ae4c21157b591c4af85880426be3c5d227

  • SHA512

    be00e7693d7cd95e84ed7985ab304ca67dd94064f3712953661459f7d757099f7dc5166125f0dd0637985c5e7b970541843aba1c29a52aafd5a9f7bf007af4d5

  • SSDEEP

    24576:BmSHHHHHJ9B2KctXn7wVD+RASAd2XhA5N26:VHHHHHPB2KYLwNrSAd2XhCo6

Score
7/10
adwaredefense_evasiondiscoveryexecutionlinuxprivilege_escalationstealer

Malware Config

Targets

    • Target

      bb98eac43874f2f08babddfd2a879bae_JaffaCakes118

    • Size

      837KB

    • MD5

      bb98eac43874f2f08babddfd2a879bae

    • SHA1

      b844a4ce25584e095057bb115084f6b2160794f6

    • SHA256

      71ed6fd674e384ddc915e47f5eac03ae4c21157b591c4af85880426be3c5d227

    • SHA512

      be00e7693d7cd95e84ed7985ab304ca67dd94064f3712953661459f7d757099f7dc5166125f0dd0637985c5e7b970541843aba1c29a52aafd5a9f7bf007af4d5

    • SSDEEP

      24576:BmSHHHHHJ9B2KctXn7wVD+RASAd2XhA5N26:VHHHHHPB2KYLwNrSAd2XhCo6

    Score
    7/10
    adwarediscoverystealer

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InetLoad.dll

    • Size

      18KB

    • MD5

      994669c5737b25c26642c94180e92fa2

    • SHA1

      d8a1836914a446b0e06881ce1be8631554adafde

    • SHA256

      bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c

    • SHA512

      d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

    • SSDEEP

      384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/LockedList.dll

    • Size

      31KB

    • MD5

      d6c18c9cdb750d7b23d5c9806b204a62

    • SHA1

      b41a65ca3115ca14102dccdf0818ac229af9461e

    • SHA256

      ee9201059695cde4aa728d9b0fd1a06278cdd6a6803c934e9d9d20fd420909e5

    • SHA512

      fc44d28a75d07e51222027dfe1b06f3bfe5454f3db3ab47d880cee0be96df31c3c82fd7c8e45b073eead741101a6eb6306bef53f4cf99e6279049f748cccc692

    • SSDEEP

      768:2XWgM6PuH9DvjM4pmTkoELZYtHhzOJQJA:2GlH9DvQ4pmYhLZUHhzKQJA

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      acc2b699edfea5bf5aae45aba3a41e96

    • SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    • SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    • SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • SSDEEP

      96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      options.html

    • Size

      1KB

    • MD5

      78d30b78b429379ad6dc5395c077a3d5

    • SHA1

      303803f9516484603b1f9c9c914e905197a96e41

    • SHA256

      ac55ba92e8cefe20e5378a9290f6b0cff8b7133cb1b3791da8c34ff724e7adad

    • SHA512

      98bf6172eb8297c51ff4f5b427bdd306fc00c68893b6c732397decb067a30ac89cbd26c81160e58b09c9fc5c34b42b70465775c2550ad2ee9444d263ddd9e425

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      popup.html

    • Size

      1KB

    • MD5

      4934237abb4bad0c689eb75319c96c1b

    • SHA1

      82bd7c64f2512d3bb4d5abb055f151e232c63e15

    • SHA256

      f96fe92ce12364ffa2770f9dcce9478d30aee0e23e7a65bd4435b8933a49b4e4

    • SHA512

      1b80e49b725d53f68bfd71cbe1ac5ae72c4f9147ac3ba8e09a0a05dfdd30d2823df40c6e82b94c3f078ecd7efe4f128d14a72d995d1c0563179fc00788723e9d

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      profilinstylin.js

    • Size

      958B

    • MD5

      7e40cdbcfdcb728ef1933e719ac5002b

    • SHA1

      f67c8fc22136d4db18dd44382aa4a2935c7124ac

    • SHA256

      7ad542d6dde2fbc3a6d687e1a75357df87d0221ec47a8a65e2dada0ffa245f9c

    • SHA512

      df1959dbc0b1c406b1cc84362cd6c5eeded702a6f89e18efbb0271df52d99fc753da8b7b0ecfad140c07586a736bdcb2b7ddc4c44eabe30745e5040c00115892

    Score
    3/10
    execution
    behavioral17behavioral18

    • Target

      utils.html

    • Size

      816B

    • MD5

      c9386e47ebe351696c1deffefdf32694

    • SHA1

      833ea035860454a0b31f2d3109e64ca6050d4bb1

    • SHA256

      d412cd44247e0cca9187ba69e924ee93955ce0a01763f4a7c1239141e06b3ce1

    • SHA512

      f1dc378f10a6f769173e84c1c04cf218755bf565921a0daf982e8bb2744b0c1ce4e2aa35d86671489c4473ec9babbb23e720b0cba434ce8ecadbf77844051ce9

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      interop.shdocvw.dll

    • Size

      136KB

    • MD5

      8b681f3640b54fdc52e86771808be6b2

    • SHA1

      0c5a485c5a38cea6a4f17823dc7c4d5cae71b7ef

    • SHA256

      066022426b0a01e3503bb8eebff98fe6451f965197dbefa0da9b4efcf8962138

    • SHA512

      27116cb7c749ac81220e4c8aaaf1352f8f3ca065ab47e2761fd657a845c54019325d67f871f90096d63e8dbefc7de53ee3fa6e766197fd7bc51405b887d06d69

    • SSDEEP

      3072:HPIboM3VHMhGjIdCf05e7w16BuIJyzEVefgBarctG345ij0FOPQxKbMd2nopSTkg:vIboM3VHMhGjIdCf05e7w16UIJyzEVeH

    Score
    1/10
    behavioral21behavioral22

    • Target

      microsoft.mshtml.dll

    • Size

      7.6MB

    • MD5

      dbfd5f3873187ec57372f6bb4627c56b

    • SHA1

      e8db5c5d6f94431e03fd25d445c615b4fec1b656

    • SHA256

      a2cde56102c48e047d71041e60af029cf1bc3117d07675f2fae391c2e0e00352

    • SHA512

      79a4976dbdbc327dd1ea8df27f3c9350d3f2f03453aa529bfe1a43f8989d0fe178fd16c8667eb13d8e4a1f4613aa3ab754b6e7bbb72447c24723464f31c6aa20

    • SSDEEP

      98304:gpkg8hn8biyAB84gPjKVuH62NhND7BMe8AlP:gpkg8hn8cStD7BMe8AlP

    Score
    1/10
    behavioral23behavioral24

    • Target

      profilinstylin.dll

    • Size

      9KB

    • MD5

      b94fe26050179b997090fa876d3c4529

    • SHA1

      a9d988c97a50557a133b9a029594b936abbd87d7

    • SHA256

      06022189b499198ce68829370e8adc8a57de16289984865d325ded6368fc3f56

    • SHA512

      4bd556d724962a57af08054a5c60aefa533e0cb225f5793bca7a47145923156456a45f1f634ce787021a948e1f62bb204ad1eb4c2bfbd4335e33626aeda14d00

    • SSDEEP

      96:ih0zB7dV19ZqkqP4wmqr+CNi1lRKEKnjrZjtgwzg4L39RwMeLJOJ14DN7DpZv:k0zHj9Z6Aw/rZglRKEmrltL/ap1j

    Score
    1/10
    behavioral25behavioral26

    • Target

      profilinstylin/build.sh

    • Size

      3KB

    • MD5

      eece87baf1509ffc027d6b22b7683955

    • SHA1

      d4a03766203c775b71eeaedc423d7920c1019f3c

    • SHA256

      c4f9c723000a08c87859623c0a11022472bfd4b8758c7530778b50bc549c1618

    • SHA512

      882e3acc7bffc4f09b7ad223b0839560e070a04467b78fb279da8e5ee72a8fa1fbd65da1bdeec4d56576232f5b50a6124c485d017c7e129283deb6edaa457319

    Score
    6/10
    defense_evasiondiscoveryprivilege_escalation
    behavioral27behavioral28behavioral29behavioral30

    • Target

      profilinstylin/config_build.sh

    • Size

      183B

    • MD5

      1d73e58cd48601149222656dc52ddff5

    • SHA1

      bdc52664eb1fe30c8679b44e0166d62ee1dd8563

    • SHA256

      bf8099b744a2256913bf02b43bd29540c99dfc7851e1513eee622af60224b85a

    • SHA512

      28d8d0699e93f03765b3d288ea878a58e514a5535ecd1a9a153d717cd02ede0b52ebd34b80a722413b3cb383dd07d2cf4ca158d72cc05626714ab17deab7b9ff

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

adwarediscoverystealer
Score
7/10

behavioral2

adwarediscoverystealer
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

Score
1/10

behavioral32

Score
1/10