General

  • Target

    JaffaCakes118_52c657629359928d335faf3305132f8e9e927df1f416079953adbc6e2b3f5c66

  • Size

    25.1MB

  • MD5

    5b63fca9fbb0bcda4badfc4a6e279320

  • SHA1

    9d1929b69f7979e25cd0442920205e69d0ca7b95

  • SHA256

    52c657629359928d335faf3305132f8e9e927df1f416079953adbc6e2b3f5c66

  • SHA512

    62ded3130f67a24125af4c6f17def7bed7113858d93d7b638206e6e743d0f64f27c2d497354a39d06067c99ea280f8a73772788315d945c362c9afe00f9ac57a

  • SSDEEP

    393216:1OWoxUoEk06LJgXm2h/3t3hkZeiF51cFT1luXxdjkHJZ7JjuaQdYXVxWkNvnuiKy:oZuutgxhPXgF5QARS5NuvdQUFow+Cfwh

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://212.193.30.29/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

212.193.30.21

Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie family
  • Privateloader family
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_52c657629359928d335faf3305132f8e9e927df1f416079953adbc6e2b3f5c66
    .zip

    Password: infected

  • 0400b38bff44e2b0ba89f392af3ec1febbe980255086e3d21ca375f8742b0a69
    .exe windows:6 windows x64 arch:x64

    a22b9c7bc0a60c74233dee9fcb4ec598


    Headers

    Imports

    Sections

  • 08577362fde99723e8821dda6871a3ea10d41ff7e7840b89458ca6813db84477
    .exe windows:5 windows x86 arch:x86

    a14fe147cbb35ac7afa52e2cceed81b7


    Headers

    Imports

    Sections

  • 0b0f1d67f69a4c98db74330aced27c3de03745796ab86fc1edfc79cc6d6d79b0
    .exe windows:5 windows x86 arch:x86

    a14fe147cbb35ac7afa52e2cceed81b7


    Headers

    Imports

    Sections

  • 12fc2e604cb1785f16d728b8e74ef1a2405891bd94202aaa0c87d87638edd840
    .exe windows:5 windows x86 arch:x86

    ba2c974ed567c90fe365844af978f320


    Headers

    Imports

    Sections

  • 1df5732dfafe442990fe6cd028f96212d27e68c2922f9acfd74e8dd9f75e93d3
    .exe windows:5 windows x86 arch:x86

    319bf6fe2c13d54d7e13af9887ef84ba


    Headers

    Imports

    Sections

  • 21babdc97540ee61d23b9f1b431716e3987dfe8b35fe21e38b4dace528f49e43
    .exe windows:6 windows x64 arch:x64

    23e911f9a82ac0d345fa6cc9104b6bf4


    Headers

    Imports

    Sections

  • 2b802f4d27860689db050439e05e067bc7e87dca596fa28765f4e3aceea2b4ab
    .exe windows:4 windows x86 arch:x86

    22bdd0a80822b853954316637729f984


    Headers

    Imports

    Sections

  • 38d5cf2bdcab25afb95cda0fd3abc7911469a4c4442966b941e930947099f508
    .exe windows:6 windows x86 arch:x86

    e71297291a62d1a2391e25e24183234c


    Headers

    Imports

    Sections

  • 3c59836d51379ebb763312245230900e181afa69064f6c8c999f1bf0d7672feb
    .exe windows:6 windows x86 arch:x86

    e71297291a62d1a2391e25e24183234c


    Headers

    Imports

    Sections

  • 498ef9748dc6e96db88710804addbe0025e6a816e6edfa6f084a7fc0e92c737a
    .exe windows:5 windows x86 arch:x86

    70a2f9c3b9dd9e8462bc025eddeeaa12


    Headers

    Imports

    Sections

  • 666cdaf066bdff233bc4dc1673a8580d8dfc2d1ba893d8bb78f6b8cd511f33f8
    .exe windows:4 windows x86 arch:x86

    cb62600ed2c95955464af5d948f6cd62


    Headers

    Imports

    Sections

  • 6a426d2bbc5b6c93082546d8098bbee627b97595ddefd07f06f7c94da0e14a1a
    .exe windows:5 windows x86 arch:x86

    e879ba3e028bb21b52e8efb1b68c0f32


    Headers

    Imports

    Sections

  • 72606a3ad198f24ee496d3f483c193121f4d9b895ac6880dda8e6406e8d16698
    .exe windows:5 windows x86 arch:x86

    dfeef827bc55de4869b81946d6f7dd17


    Headers

    Imports

    Exports

    Sections

  • 72afc3f26cacbc0b9a5dca8a10186451bb91c77fa445ab15639e96623dd64e60
    .exe windows:6 windows x86 arch:x86

    9734ba8626408cec04bb8fa7d8bb6e83


    Headers

    Imports

    Sections

  • 743f0e2d18f4945d7e58bc594c448fd1540e31ffcf07fbb85b90e15d5593a8a9
    .exe windows:5 windows x64 arch:x64

    bda4b06bad8249ae0fe30865f30cbab1


    Headers

    Imports

    Sections

  • 7ac9ad7a4af22b95852904323573d0774aa8b5d66f3a8b76ce9614e4fd965e90
    .exe windows:4 windows x86 arch:x86

    e77f32f8bf63e08996bef216343a8051


    Headers

    Imports

    Sections

  • 7b93645945ac44133c9b135378fe144506e79b92f99790fb3755582e62417324
    .exe windows:5 windows x86 arch:x86

    304901cae67bf203abbe681c1d006f6b


    Headers

    Imports

    Sections

  • 963f8b33241c09c74d3dd128f53587d9baa3c7d2bd05982add87fc4d8a860e85
    .exe windows:5 windows x64 arch:x64

    04f7f1cdb86c1e9cfa146c815446ca1a


    Headers

    Imports

    Sections

  • 9d07b6db712b0efcf829adc512c1f939901bacf1fa522b04a143f41f8155fa3b
    .exe windows:5 windows x64 arch:x64

    14cf8f87d7eefee36338756e049a016b


    Headers

    Imports

    Sections

  • a65e068b949cec8f97be0db9562fc617c1e7ac4a6acf0f25bd915fe3d7fdfca9
    .exe windows:5 windows x86 arch:x86

    f2184a0e7d21805216ecc4d9e9e0bb3e


    Headers

    Imports

    Sections

  • af658b52e99d23b9052a95de1f97a01b15b485fc36abe81d7dc59681d53e1260
    .exe windows:5 windows x86 arch:x86

    e529111610a285ea8fb904ef0e6a50cd


    Headers

    Imports

    Sections

  • b6a201e482c801e895ac6e97f6e22fd65652b642bdbcab42a0f02d98874e4365
    .exe windows:5 windows x64 arch:x64

    2d6f4e096a2d15d4349a455f88e1f66e


    Headers

    Imports

    Sections

  • bc1b65dc3fe62ce8dd93f0e5fe94eea30dc697596387d74288a28e383bd4d936
    .exe windows:6 windows x64 arch:x64

    8e36ff2cd61db3b58797f70a75c36d68


    Headers

    Imports

    Sections

  • d091a553b697168ae70b054182d1b163c64118a850c525089189e964cd8d15cc
    .exe windows:5 windows x86 arch:x86

    1d75307687b1f5d87b642a6de0fe893a


    Headers

    Imports

    Sections

  • dbd00acced0e33452e54c60e56b3cb3bce401f603953c6c36cb3a320dc549061
    .exe windows:5 windows x86 arch:x86

    a14fe147cbb35ac7afa52e2cceed81b7


    Headers

    Imports

    Sections