General

  • Target

    JaffaCakes118_33bca0b7c35d92fe1dec4638d803349ca76a0f4b2a647efa49697edb77d2ae95

  • Size

    5.9MB

  • MD5

    67d4a8ca3787d8c5971f41705dbc7580

  • SHA1

    310f453626a240b6c374068a61b83337ea070a23

  • SHA256

    33bca0b7c35d92fe1dec4638d803349ca76a0f4b2a647efa49697edb77d2ae95

  • SHA512

    3712ebd6772d997c61d0450be8b9be5ab2b1b9cf5b234e4603e51f7b17223b0d110daeb46bf31004b205c54c0acfe96c56f5cd21830a97a27a1ae75508215382

  • SSDEEP

    98304:DZnGeMZ7Jwl0XmqXcgaJuzS+TPcxXAJOgceUNCqIclfiuVKDRR8En7PUORKOxLBm:D/MZ7Am9YuvExXkOeUNCq6ug78ORBxLE

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://45.144.225.57/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

2.56.59.42

Extracted

Family

socelars

C2

http://www.chosenncrowned.com/

Extracted

Family

nullmixer

C2

http://raitanori.xyz/

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie family
  • Nullmixer family
  • Privateloader family
  • Socelars family
  • Socelars payload 1 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_33bca0b7c35d92fe1dec4638d803349ca76a0f4b2a647efa49697edb77d2ae95
    .7z
  • 7zSCD97F9B7/16409730233472.exe
  • 7zSCD97F9B7/16409730238228.exe
  • 7zSCD97F9B7/1640973023982.exe
  • 7zSCD97F9B7/61cf42cab6116_Fri1740da7b7c.exe
    .exe windows:4 windows x86 arch:x86

    3e6ae7d21837342245b8b4fd135fcfeb


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42cc94cfd_Fri174cd2108.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 7zSCD97F9B7/61cf42cd9d3e3_Fri172b3fcd2f5c.exe
    .exe windows:6 windows x86 arch:x86

    f357e85531c6f51e747b50e32a172ccb


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42cf81412_Fri1748d73b51.exe
    .exe windows:6 windows x86 arch:x86

    d69e4c13e25f0ad622344ac56118c0df


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42d8cfbf4_Fri175590209.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42d96bbd5_Fri1768e6cd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42da3aadc_Fri1749497d9d.exe
    .exe windows:4 windows x86 arch:x86

    599f9969860293e114e6ed9b51af2061


    Code Sign

    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42db8e020_Fri179863c92d69.exe
    .exe windows:5 windows x86 arch:x86

    e92b2275a730f59940462780c383a1b0


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42dc105f3_Fri17e8bf67cf5c.exe
    .exe windows:6 windows x86 arch:x86

    6423e263428ff2e62e44b0a54d915de5


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42ddca121_Fri1754a29da57.exe
    .exe windows:5 windows x86 arch:x86

    c613013e8ec93eae360257b5231d0949


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42de1af96_Fri179a299200.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/61cf42df34a5e_Fri1721957b061.exe
    .exe windows:6 windows x64 arch:x64

    23e911f9a82ac0d345fa6cc9104b6bf4


    Headers

    Imports

    Sections

  • 7zSCD97F9B7/libcurl.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 7zSCD97F9B7/libcurlpp.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 7zSCD97F9B7/libgcc_s_dw2-1.dll
    .dll windows:4 windows x86 arch:x86

    04f9a5136edc374e78bc81dc8b0d07af


    Headers

    Imports

    Exports

    Sections

  • 7zSCD97F9B7/libstdc++-6.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 7zSCD97F9B7/libwinpthread-1.dll
    .dll windows:4 windows x86 arch:x86

    fc24104becbbff1210c7fd71e49c8b5f


    Headers

    Imports

    Exports

    Sections

  • 7zSCD97F9B7/setup_install.exe
    .exe windows:4 windows x86 arch:x86

    f9fc0ecba4bcf3f4eadacd9b358488bc


    Headers

    Imports

    Sections