General

  • Target

    JaffaCakes118_e446bd97230671b6e38682ec9f3da7527c18dbd555efc7f27a52d144cf54edcc

  • Size

    139.9MB

  • MD5

    f69be0b5e5b4b203013e7504fd24751e

  • SHA1

    ccb9cedd5ad3f880f9aa8754c0661ae69eed210e

  • SHA256

    e446bd97230671b6e38682ec9f3da7527c18dbd555efc7f27a52d144cf54edcc

  • SHA512

    3615aebd1cdd1eab2adee010210cc0f1f198bcd79d75d0d5c216acd17fefac121cff984c82aa1c580971ce49ffac0e77f54abf8d57622d065b4f38ce857dd7af

  • SSDEEP

    3145728:z5Nl80yN+c3dNlPFXjQnIEf4m3WMdrLJHBnG:z3yd9TnUIEg0a

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detects Zeppelin payload 1 IoCs
  • ModiLoader Second Stage 2 IoCs
  • Modiloader family
  • Xred family
  • Zeppelin family
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 41 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • JaffaCakes118_e446bd97230671b6e38682ec9f3da7527c18dbd555efc7f27a52d144cf54edcc
    .rar
  • 1.bin/1.bin
    .exe windows:4 windows x86 arch:x86

    5877688b4859ffd051f6be3b8e0cd533


    Headers

    Imports

    Sections

  • 2019-09-02_22-41-10.exe
    .exe windows:5 windows x86 arch:x86

    0b940f4d2992021389a241ab8513fc6b


    Headers

    Imports

    Sections

  • 31.exe
    .exe windows:4 windows x86 arch:x86

    5877688b4859ffd051f6be3b8e0cd533


    Headers

    Imports

    Sections

  • 3DMark 11 Advanced Edition.exe
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • Archive.zip__ccacaxs2tbz2t6ob3e.exe
    .exe windows:5 windows x86 arch:x86

    ecc8b2d72205d5666936947a45fa8392


    Headers

    Imports

    Sections

  • CVE-2018-15982_PoC.swf
  • CVWSHSetup[1].bin/WSHSetup[1].exe
    .exe windows:5 windows x86 arch:x86

    3c977911c8eee24abac5edc906e5e72c


    Headers

    Imports

    Sections

  • DiskInternals_Uneraser_v5_keygen.exe
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • ForceOp 2.8.7 - By RaiSence.exe
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • HYDRA.exe
    .exe windows:4 windows x86 arch:x86

    3abe302b6d9a1256e6a915429af4ffd2


    Headers

    Imports

    Sections

  • #/power.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • #/sant.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • #/ufx.exe
    .exe windows:5 windows x86 arch:x86

    3eaa732d4dae53340f9646bdd85dac41


    Headers

    Imports

    Sections

  • #/va.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Keygen.exe
    .exe windows:4 windows x86 arch:x86

    06ac1f21ee2a357ffb0dd7db52cbbb13


    Headers

    Imports

    Sections

  • Lonelyscreen.1.2.9.keygen.by.Paradox/FILE_ID.DIZ
  • Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • Lonelyscreen.1.2.9.keygen.by.Paradox/Paradox.nfo
  • LtHv0O2KZDK4M637.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • Magic_File_v3_keygen_by_KeygenNinja.exe
    .exe windows:5 windows x86 arch:x86

    4cfda23baf1e2e983ddfeca47a5c755a


    Headers

    Imports

    Sections

  • OnlineInstaller.exe
    .exe windows:5 windows x86 arch:x86

    5bd730b74335de2d8c76ffbc12562b9c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • SecurityTaskManager_Setup.exe
    .exe windows:4 windows x86 arch:x86

    60f2858f8c859062bd16000a4cb2a2ed


    Code Sign

    Headers

    Imports

    Sections

  • Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • VyprVPN.exe
    .exe windows:4 windows x86 arch:x86

    4f67aeda01a0484282e8c59006b0b352


    Headers

    Imports

    Sections

  • $1/1337/VyprVPN.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $1/1337/joinResult.exe
    .exe windows:4 windows x86 arch:x86

    4f67aeda01a0484282e8c59006b0b352


    Headers

    Imports

    Sections

  • $1/1337/1111.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • $1/1337/Clipper.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • WSHSetup[1].exe
    .exe windows:5 windows x86 arch:x86

    3c977911c8eee24abac5edc906e5e72c


    Headers

    Imports

    Sections

  • ___ _ _____ __ ___/전산 및 비전산자료 보존 요청서.tgz
    .gz
  • 전산 및 비전산자료 보존 요청서.tgz
    .tar
  • 전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
    .exe windows:5 windows x86 arch:x86

    93b970b63b735db9b186365630218e72


    Headers

    Imports

    Exports

    Sections

  • 전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe
    .exe windows:5 windows x86 arch:x86

    93b970b63b735db9b186365630218e72


    Headers

    Imports

    Exports

    Sections

  • ___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
    .exe windows:5 windows x86 arch:x86

    93b970b63b735db9b186365630218e72


    Headers

    Imports

    Exports

    Sections

  • ___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe
    .exe windows:5 windows x86 arch:x86

    93b970b63b735db9b186365630218e72


    Headers

    Imports

    Exports

    Sections

  • amtemu.v0.9.2.win-painter_edited.exe
    .exe windows:4 windows x86 arch:x86

    06ac1f21ee2a357ffb0dd7db52cbbb13


    Headers

    Imports

    Sections

  • api.exe
    .exe windows:5 windows x86 arch:x86

    aea9c61b49d66485f9f13c0f478d0b02


    Code Sign

    Headers

    Imports

    Sections

  • default.exe
    .exe windows:4 windows x86 arch:x86

    8acb34bed3caa60cae3f08f75d53f727


    Headers

    Imports

    Sections

  • efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
    .js
  • good.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • infected dot net installer.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • oof.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ou55sg33s_1.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • update.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • vir1.xls
    .xlsx .xls office2007
  • xNet.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections