General

  • Target

    JaffaCakes118_62d3cf238a7365d9176a9c0378c0e729

  • Size

    1.9MB

  • Sample

    250115-1qe4kswmav

  • MD5

    62d3cf238a7365d9176a9c0378c0e729

  • SHA1

    de505c22718ba47ab18043dcfe599287554bf718

  • SHA256

    100fda8fff014997d477df6313e514d7eb6697c10a83c4dde76d54cea27a3fa7

  • SHA512

    7e9620ffd0c3e0d1b639ccb8b0e45b93eac1fa999d7e701c13126ac821af7a7476ebd00c5ee9d32fd32849154fecd44d1d2c58d75dd92ffe54d4e79b4b9b948b

  • SSDEEP

    49152:9AtPzkdYt+64s1CRVeG1LxcsN/exbpLH5Cfizo322bySs1CRBt+6b:OVzIYQw1CRMG1Lxd/ephZ9zo/bg1CRBl

Malware Config

Targets

    • Target

      JaffaCakes118_62d3cf238a7365d9176a9c0378c0e729

    • Size

      1.9MB

    • MD5

      62d3cf238a7365d9176a9c0378c0e729

    • SHA1

      de505c22718ba47ab18043dcfe599287554bf718

    • SHA256

      100fda8fff014997d477df6313e514d7eb6697c10a83c4dde76d54cea27a3fa7

    • SHA512

      7e9620ffd0c3e0d1b639ccb8b0e45b93eac1fa999d7e701c13126ac821af7a7476ebd00c5ee9d32fd32849154fecd44d1d2c58d75dd92ffe54d4e79b4b9b948b

    • SSDEEP

      49152:9AtPzkdYt+64s1CRVeG1LxcsN/exbpLH5Cfizo322bySs1CRBt+6b:OVzIYQw1CRMG1Lxd/ephZ9zo/bg1CRBl

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      background.html

    • Size

      2KB

    • MD5

      b7d357be8cc4c11c58c93d6fd7999527

    • SHA1

      2a86f49e41d1ae1c942efc3abe7a740def252d4e

    • SHA256

      ac6e1a6a03b8e6c7565c0d0b856f9882ddf6a05fc9a1c0d6f8523e53aba7c403

    • SHA512

      6e23c3dfb7cac97385d92b1e312e8bd3c7a534fb2de9a104de612cc9a6a479f977e77ab9c4f3ef628a69259db0e23d8daa9bb0890454a78278c9fdcf33ba213f

    Score
    3/10
    • Target

      background.js

    • Size

      12KB

    • MD5

      f2bee04a4b392400cc70dd997429ef78

    • SHA1

      87ed1ee2adcf041d6378680b534982d3d0df95e1

    • SHA256

      ef368ab22ef7ad41383ab04fabbc964f9ced5b7cb9dc5d706734b5f409f34e11

    • SHA512

      44e4664c7555083eaf80e32ce94dbf8463583cadae93d0da25df242821c82badfbd120f495d469e756df0e5195bc147aae1735d108c9d4d04c8587bb5f996ba9

    • SSDEEP

      192:CrXlfXpNxZy9fDPgrKveB7Q3IKCNqt+k8ussuPaOm3chAdyonLLFVPutjPKGxgUb:C0hDIHYCgnjssuCXeSLFVPulPPxgUiG

    Score
    3/10
    • Target

      extension.js

    • Size

      7KB

    • MD5

      f1e13daf714637647aca5ec518ce96d4

    • SHA1

      abaf3024430a7bc35c5e321776e7009e7f6bab27

    • SHA256

      10679736358b9dbf38a4fc53b61b334639168c3a211e743a2a0252da6a654c5d

    • SHA512

      de2c3f926d7928912f505da57505b695c343c187d1a21068c923ce5e6d00a090fccdf5c29167e3b25b0eda788b9ad7c84ac578132738e16914a4335747ebcde6

    • SSDEEP

      192:f6A54AcMMKfxCFpJEAEEktqITQLCfa18nnrakHTbh3Y18Oxy1clGx0X:fffcMMKfxCFecwnuwTbh3Y18PeGQ

    Score
    3/10
    • Target

      js/api/chrome.js

    • Size

      2KB

    • MD5

      8f98ee39c34e3218067b669f9311b0e6

    • SHA1

      e5839e98202cc2a5fee75bfe58d5a38940213db2

    • SHA256

      a81ee4ba74e932c2b7b73eef065840ba142b00f18663a2e8f8e2b5252e9bae61

    • SHA512

      2c1f5ed2e0f20b0ae29254bc4d0ddaee459dae84e4326f680f4e55243892767ed9e4cfbb3d1bff87f580e57edda1799d7f58495bf76a984394552c05573b14b2

    Score
    3/10
    • Target

      js/api/cookie.js

    • Size

      3KB

    • MD5

      d34233c7039a88311d7383704be5ec22

    • SHA1

      6fec28b10082907ffc954ed79f4053508ed433dc

    • SHA256

      29419599c3f50c1b1033b65f9f8caf6d3b2444fa3713e03f5d404c291daebae6

    • SHA512

      8a8033361e1d1389fe51f73fe8f4c0fe08d3172a9ff6677a313ae688157e5c4441077972d3f4b73a80b2e61d52e8ecff72019d9702fa861daeec075722747290

    Score
    3/10
    • Target

      js/api/message.js

    • Size

      935B

    • MD5

      0b7a6cca1c7b59c3c9f23e11aa86f8f7

    • SHA1

      e894b4d7926c245127156c122917e2507bb74fa3

    • SHA256

      506ba14f4b4428a1e8ed875541b442d166f4c50bd6e388f7804ff96a30391554

    • SHA512

      448bb4e9f643f9300680b04c98123f5ed1619d9834fe36806c58a28976586b56b5496ea839ec2a553275eba1c1261d8da96c5e0d40bddb600e73148bf120685f

    Score
    3/10
    • Target

      js/api/push.js

    • Size

      1KB

    • MD5

      256714f754773b5e970dd5e2d5e3c605

    • SHA1

      ede01916854e04da38d34393fd2ba6eb9d91ccfd

    • SHA256

      fa4b7e891c021e9e15692d5042d6a7678958c623904c6e053a3efc1ff705cff1

    • SHA512

      6d2c433c84e3805137159e558bf73804fa81b54b64fe6ae4ffdde12231b5c1b27303370ac383503ce82ae5a62247aced515178ec4ab50e8d6a7735dc68d73ca0

    Score
    3/10
    • Target

      js/background.js

    • Size

      30KB

    • MD5

      fc62b171af3dc012457ed971ba5413f8

    • SHA1

      49da73b0310deae4f031190d2627152aad75e439

    • SHA256

      279cc35fc5a26ce12260723bc82cf37f2f757622a651cbd1643e15a084c3039e

    • SHA512

      555b61eecf10fcf3eed4dcc149e8e0267390d8ab6302269d22ba56d174ac7f6a64047c4ed9793947cb5c999e9a4cb373d2021fceee95483ff7985419cbf8f031

    • SSDEEP

      384:/jMzVKz2zV0riR5AZR4EmSlylx3YOjINbtf/SvylM6Sdbs1rhMwkiyK:/jEVw2zew5ORHlylxHjEasQbfpPK

    Score
    3/10
    • Target

      js/lib/app_api.js

    • Size

      4KB

    • MD5

      5121628e1dfe945e453e65a7a60164d7

    • SHA1

      e1e304bbb9ebb822f937cb0751202be3ad2f41b1

    • SHA256

      98251dd640bfebfb3d2ecb7a56079fc22a71d76b302586985b8cc8b1949fb293

    • SHA512

      7e20aaf20182f2f99fba8e0ba5aaaa3066e38709d4e6435953876929dea0e00661a084ca54585409090c3a498333820d9a0f242188ab383048a112dd91f06f24

    • SSDEEP

      96:9DWBKTOG2rL0D6cZEqZuWSxSqKRWyMMRwD:NWBKTONw6LVWSxSqyMDD

    Score
    3/10
    • Target

      js/lib/async_api.js

    • Size

      2KB

    • MD5

      63e99370260fe9e6f95f4c6b31abe9ae

    • SHA1

      84deeb5ad34c7040523c57e5566056952ade226e

    • SHA256

      25ccaa210cd9d34aca63e0215fc311faa703ad8647dabc05d5ca901de075f466

    • SHA512

      6ae8b8c1c974348039c106f5786414c8273fca6c59799886695bf9ccc41b4127233f8b5cfc132847106078213b8112802b3b9f36de16ab4b2a25777af3f2d5fc

    Score
    3/10
    • Target

      js/lib/bg_app_api.js

    • Size

      1KB

    • MD5

      f55c415e70631695b28fdc1a0ea7b932

    • SHA1

      f9a43480e9eb71dec7b1a5331fa00ed99b716efd

    • SHA256

      3bc5a149987dae560a5bd77412740c0eb3b4b13ea3ec9e93e79980956d0bcc8c

    • SHA512

      ffcabefbbd450b004321ca3ebcf2efb675cb637ff27d5d7e5377ba70d716ee985c158077f70d50e90d6e6c960ecc9db3ca89e54edb5c554d80f53a1940b4b2fa

    Score
    3/10
    • Target

      js/lib/cookie_store.js

    • Size

      3KB

    • MD5

      f8e85bffa7c33a56d88e9ca20be19fdf

    • SHA1

      abd5932a14e1ec308329d23415c51c13d9d3e284

    • SHA256

      92bbbb49ebbf9647980841fa3bf3605b7f0b1995088ad8501e3013b9cfa46d3e

    • SHA512

      65a073b3793ce96f9a15782568773c7cf29a7d8a74919e14adfdce367b242de20613f25675966dc521b507836a12479fbde74c869691b30d51508498c0d50224

    Score
    3/10
    • Target

      js/lib/data_store.js

    • Size

      5KB

    • MD5

      64af1f5f51bd15691d1666b50e69c652

    • SHA1

      08c058e4075b8fa2188664ee1f91e6ec43127be2

    • SHA256

      cc6f46c27c260b099d7f2b9cabe2e057a60cd5e2ba08dcdf19614c64c8a5bf13

    • SHA512

      888f85d959fe3a5bf0006b251af39fed3b2f98799e85206d158c43015921f7ead5774e183678a83fe93f89898c8ff86fe96a153db2239a1cf5ed3350aeaa6c2e

    • SSDEEP

      96:zjuo9efZ4ZeZFVpL0VUDyx/Yx2Up0kCRf8vp3zLZcGD86:zb9g4YyxTUpXRBz9pD86

    Score
    3/10
    • Target

      js/lib/faye-browser-min.js

    • Size

      22KB

    • MD5

      414c41ba53c3be4ad03f86665d3009e3

    • SHA1

      0805a60a7c0f3e2448b51ccf44744a2670cffbce

    • SHA256

      2d924bda660d5dcd5209de04454c16ae76a43cc37ccf448e10929a1f5462de2b

    • SHA512

      97ce7d4584124310628fc9681c55229a1c705b232faf527a68d01bcca38778496a4509ebc7a63d0b532fcb9dcf21db32fef9328dc8a0e422fbb100887b4506a2

    • SSDEEP

      384:GLTLVN6xcKAQpecdyCaSXt7wc4ch8h3vGleECZrTESq:GLn5Kxd5SckfGleECFbq

    Score
    3/10
    • Target

      js/lib/util.js

    • Size

      1KB

    • MD5

      71e7320b03281f56baf47aad5774d6f4

    • SHA1

      80b952249df45a4b7f1f5bb771639ea87f052483

    • SHA256

      c2089db233311f0fd2b031edecfebe901193ffc2694b099bc720b8f0bbb3d3c3

    • SHA512

      4fee6a88ea389357e27fcdbb940b5f8229b1a34c4327ff41cba76eac15f39269330767b1129c1062cf33f23192ddcf56364798457f094c0113fc421ec8f008e8

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

adwarediscoveryspywarestealerupx
Score
7/10

behavioral2

adwarediscoveryspywarestealerupx
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10