General

  • Target

    JaffaCakes118_6014b30bcb29b6bcc758164ee4057e84dc08180c12688e2396dd638f2142c322

  • Size

    853KB

  • MD5

    3f07601c9e60d83a9bdc46f7d771473e

  • SHA1

    c904774644f38785645ac5300b37e7b53754bd75

  • SHA256

    6014b30bcb29b6bcc758164ee4057e84dc08180c12688e2396dd638f2142c322

  • SHA512

    b8ac7dce230edceba1b121a9b264d408a037d6f3b5375e31738948d008db859c695b4fedae6e0aae76df732f71f72581ab7b962f8c56c28c2c02e5fa76953a23

  • SSDEEP

    24576:n5aIeEHCbAJcreVGxzKjqsclfIwK/BW4q:5HybAJOeVGxzKjqscUBW4q

Score
10/10

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

  • Berbew family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_6014b30bcb29b6bcc758164ee4057e84dc08180c12688e2396dd638f2142c322
    .zip
  • 7b707d7788849ef1b8722aaea161ee016228239f0713fce4cb9592552f6715f8
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 7be6c0d38ef7ac12dbfd8a45d5b9513934d1e1195eb62c7cb44f103269b1bbce
    .exe windows:1 windows x86 arch:x86

    0b36fc85e0cb5e337c80982db5210969


    Headers

    Imports

    Sections

  • 8e9d85ae521c93539b3c58c3c9f3aedfe235ee4cea0688f580fc67cefdbeaa28
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • a246c7a0362b24c2022ebdb4c229f3c8bdd0f8541f55880a03d394f85aa10582
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • a8a9389353cbc3155ef587c59f6f2e250740cbad4c7bd1c6f3ff501652f593c4
    .exe windows:5 windows x86 arch:x86

    2bebfeed967f4b4de0752ac3bbbdf4e2


    Code Sign

    Headers

    Imports

    Exports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.