Overview

overview

10

Static

static

3

JaffaCakes...78.exe

windows7-x64

7

JaffaCakes...78.exe

windows10-2004-x64

7

$PLUGINSDI...lW.dll

windows7-x64

3

$PLUGINSDI...lW.dll

windows10-2004-x64

3

$PLUGINSDI...-1.exe

windows7-x64

3

$PLUGINSDI...-1.exe

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

3

$PLUGINSDI...on.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...eg.dll

windows7-x64

3

$PLUGINSDI...eg.dll

windows10-2004-x64

3

$PLUGINSDI...pp.dll

windows7-x64

3

$PLUGINSDI...pp.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ch.exe

windows7-x64

7

$PLUGINSDI...ch.exe

windows10-2004-x64

7

$PLUGINSDI...en.exe

windows7-x64

7

$PLUGINSDI...en.exe

windows10-2004-x64

7

$PLUGINSDI...86.exe

windows7-x64

7

$PLUGINSDI...86.exe

windows10-2004-x64

7

AV MP3 Pla...er.exe

windows7-x64

3

AV MP3 Pla...er.exe

windows10-2004-x64

10

AVDataPr.dll

windows7-x64

3

AVDataPr.dll

windows10-2004-x64

3

AVFunnySpaceCtrl.dll

windows7-x64

3

AVFunnySpaceCtrl.dll

windows10-2004-x64

3

AVOrganizerCtrl.dll

windows7-x64

3

AVOrganizerCtrl.dll

windows10-2004-x64

3

AVRegLib.dll

windows7-x64

3

AVRegLib.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a4a4ad40a0647cd5660ac59795045678

  • Size

    9.6MB

  • Sample

    250118-j7sbssymhr

  • MD5

    a4a4ad40a0647cd5660ac59795045678

  • SHA1

    8b643d793b216a85656f620d7c2fdc2a55cd72db

  • SHA256

    177da7fd9ca1cd14410bad2c87ae228ce5f234e9c0cbc375c399a929eab49f52

  • SHA512

    d8a6a417969ce2870bef96e4fe190031617826789e9c6746e5674379a9c58f8afb88ad33869fb03486613b9de1e82b8e3da775a2ba610dd7a08282ee23453a32

  • SSDEEP

    196608:RE0866zpZkXdiEMNig49X83sSW46wh/OvvRUyMmcyrpSm4Iv34j8pOZhl2IwYCHd:RR87p84HL49XBt46IOv6yMmx193npOZQ

Score
10/10
bruteratelbackdoordiscoveryspywarestealer

Malware Config

Targets

    • Target

      JaffaCakes118_a4a4ad40a0647cd5660ac59795045678

    • Size

      9.6MB

    • MD5

      a4a4ad40a0647cd5660ac59795045678

    • SHA1

      8b643d793b216a85656f620d7c2fdc2a55cd72db

    • SHA256

      177da7fd9ca1cd14410bad2c87ae228ce5f234e9c0cbc375c399a929eab49f52

    • SHA512

      d8a6a417969ce2870bef96e4fe190031617826789e9c6746e5674379a9c58f8afb88ad33869fb03486613b9de1e82b8e3da775a2ba610dd7a08282ee23453a32

    • SSDEEP

      196608:RE0866zpZkXdiEMNig49X83sSW46wh/OvvRUyMmcyrpSm4Iv34j8pOZhl2IwYCHd:RR87p84HL49XBt46IOv6yMmx193npOZQ

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/AccessControlW.dll

    • Size

      12KB

    • MD5

      e378224790dc97b0b3045a5c5326f203

    • SHA1

      60ab41d4b32b7778481c8f8e1dfc570dccd9098e

    • SHA256

      ed4054fa42caf43da96c6284103c457a0ebfeb58b68a7849d03bc5bae70fedd9

    • SHA512

      e08a18d3da16ffc30d9912a64d5fc8c004644a8ab4d96f2d51b2111de2f046ff7d158c678460fb911a363b873476b2c7b725e4f74fbe3927514f64400856bb78

    • SSDEEP

      96:R95tY8wLTTFH1eDqfEHUoGVg0aXl3XdGdqle9VfPpM1m2Nt7uG3OETKWgyII1rfW:znmTRH1eDqcHUZVwVndGdM4W4GBjx9f

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/DealioToolbar-stub-1.exe

    • Size

      1.2MB

    • MD5

      381735a69d098fc386afe60b4378d9a7

    • SHA1

      c4e49699266788d9a7c0aec416daf7de509dd7dc

    • SHA256

      61544878d48ae0d8fbe1dbe6444263996a4f2ebb6c075ed42a5740e5f5ffa2a1

    • SHA512

      c92a378a5aaadc9776d2dddb9809e5c42bd63bf695547d67d93ac0441fc45963ed3b82c53e5fa1fcf7d516275218eb8b9513f6deb9ad32af13ef72fed72b520b

    • SSDEEP

      24576:gMnea16HiW5Ean/KAgyFHre30v3TaP7QWFa+:gM9jWx/KmK3KTajZt

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/GetVersion.dll

    • Size

      13KB

    • MD5

      ae85debc48eee67767735e22fbcabd4f

    • SHA1

      7816874fb0ac1636ef405ac10d726835cdc9619b

    • SHA256

      bb7e0835019c837df5bce018cafd29efd179ac92530c92f42bc55dca6848a203

    • SHA512

      01f7108b63d0aef3ef49e851a1a6738d5a02e4e1505bebe81a96fc48304faaa79cc1e0b6c9479175d349461d3995a6d7ecf2fab49799e3521491f306bfeef07b

    • SSDEEP

      384:E384+Nsc2AaCHhZwpAK8UbN5bLoyci2SUQpeiBfPJc44Bi46AQ5VuDgR:E3mpK3bLoyci2SUQNm0

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      15KB

    • MD5

      67d8f4d5acdb722e9cb7a99570b3ded1

    • SHA1

      f4a729ba77332325ea4dbdeea98b579f501fd26f

    • SHA256

      fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7

    • SHA512

      03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f

    • SSDEEP

      192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/ModuleReg.dll

    • Size

      12KB

    • MD5

      fe9c588bcb5df4df85a8a35e9616e102

    • SHA1

      5e209360541da22601b2578edf8ba786bdc8d35b

    • SHA256

      f2c28caea1e8f7d6b4b678ae22e15b61b89e6ca1d40515b522636797d68abd4b

    • SHA512

      26d2747b2994b3bc5514325963c27e1143a525ca0ce3f3f11c3e0081826e3cdb4dc26b49c73086b224de20cef2543c48a1f8c3a61e666665d992d2dde728a709

    • SSDEEP

      192:8/OFpxTFP8enLPV/pruscRvTOVEW7Arm2S/rOR3XgEqxAcpFL:8/OFf2eh/p4xTOVEWsrxSjOtQj/

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/NSISSupp.dll

    • Size

      66KB

    • MD5

      5704666a02b5332298d6a27979e13cb3

    • SHA1

      b2945f994835b6679dfa98364890140661de64eb

    • SHA256

      7e6b355ee50b87856aeab233c99a3e50cce4bc82eb50fd7c7c6879d8967128e3

    • SHA512

      aa072d7be370abd6f00cd9b4d965cc252782373ca8c119ffd162ddf8d3001905c06e9de6e23cf764abdb65896462b6a05b7225176a31a4718ec9f1637a1cb390

    • SSDEEP

      768:RkJSnUeu4jMxm/h4zIM9JMkUvZVwqVB5+IUliUJxqe+Hp6Z4oWo4JGqeq5YOrg/:aJcL4E4zIMzMdZ4IFN6Z4oWo4JJ5Y

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      959ea64598b9a3e494c00e8fa793be7e

    • SHA1

      40f284a3b92c2f04b1038def79579d4b3d066ee0

    • SHA256

      03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

    • SHA512

      5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

    • SSDEEP

      192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/Toolbar-SetDefaultSearch.exe

    • Size

      187KB

    • MD5

      59fab1b92573118a4f24bd097863e338

    • SHA1

      60634ff68a50d4935da2a869a5a85fa060aa6c94

    • SHA256

      f46ffe8b4fc2d5f4a79c7d19d9cf95c1e58beedcc4f73ceb286ab7603172e267

    • SHA512

      7497972d7e964345e08906754fec4d094e150236195533587c3cb9197323b907a1ff3ef92bcfb70770dfb675f9d64cf5a820b639797fe4d4025b63fae49fe653

    • SSDEEP

      3072:wY0AZ2H8mOeA21dN5ANbm4Nz9LrXRPJ4V72ejNi5OIqLb+LzW8d8mo:wY9Q82P1ANbmIZLNPywepCqLezWpm

    Score
    7/10
    discoveryspywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/pcfix-v305-en.exe

    • Size

      1.1MB

    • MD5

      4c75a3d68c97221315e7495fcc82a036

    • SHA1

      c1334ceeea56cb984d65bc45d49eef578e700efe

    • SHA256

      09efb6e313ce5cae07d7884bdfd9ad546c31e964cf53c0b5638cdfcf36f8d558

    • SHA512

      ebb756a110675aa368a03574ba44dbedadcac6bb263e8d0ba13718961f48defdda223b67e9fdcb3a0ae1c736374fccecee7766c8aa13f0e4ec4c195dd40b9b0b

    • SSDEEP

      24576:9naG0Qv7yaJUQuFxdxnwb/acJKG7Sl4g54jKa9sI2uFtbo/U:9agXJw4b/zJKTl4g57a9sCHb

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral19behavioral20

    • Target

      $PLUGINSDIR/vcredist_x86.exe

    • Size

      4.0MB

    • MD5

      5689d43c3b201dd3810fa3bba4a6476a

    • SHA1

      6939100e397cef26ec22e95e53fcd9fc979b7bc9

    • SHA256

      41f45a46ee56626ff2699d525bb56a3bb4718c5ca5f4fb5b3b38add64584026b

    • SHA512

      4875134c664503242ec60717232f2917edca20286fc4b675223edbbe5dc0239ebfaf8f67edd76fedcaa2be5419490dc6f47930ca260e6c9988ccf242416c204b

    • SSDEEP

      49152:DQC7p7i0AY9PE1UJEfcnKiJ/K7+RIaCSi3haenvUvwwZDfimxQ02BhoZGxaJq8QQ:DLp7ilY9CQEcKz+kSixJvzwZeK2ggYK4

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral21behavioral22

    • Target

      AV MP3 Player-Morpher.exe

    • Size

      433KB

    • MD5

      57fe3645106cd88eba409cfc302a9dd6

    • SHA1

      06da7a86f9b1087bd5894f7d61bf92a256b28268

    • SHA256

      7247d0170e44761845d592539ce499dbf3136bfffd4956f4c6e28d8b8e8c6a9f

    • SHA512

      f7769111e45cdee5cca717f70a66e425d0f76c4178a3f27a10858d234d4dd768d64cc733fcee268742ddb38b35b754cb2412366f0066b255935c926157109fca

    • SSDEEP

      6144:X9Xdchs2vUcEcUyYn+ccks6d/W/FI0wbyO4ymX1iGGT/8KIwJtAzWecK19oPj:ZdUUc3ZYndP/W/FI0WGXgHLIw1e/9o7

    Score
    10/10
    discoverybruteratelbackdoor

    • Brute Ratel C4

      A customized command and control framework for red teaming and adversary simulation.

      backdoorbruteratel

    • Bruteratel family

      bruteratel

    • Detect BruteRatel badger

    behavioral23behavioral24

    • Target

      AVDataPr.dll

    • Size

      112KB

    • MD5

      6e6ab66c9f19c53acfdc50e573f80ed2

    • SHA1

      4d787284ed6dfe91432f917f45e7b4120c9229c3

    • SHA256

      649d2818be7429ff04c7a19c0220b030520f50e12d00c9ccd75654d7a6882e81

    • SHA512

      c68b130a21acb9461f445c7c16bd821336718401c880cce7a9046a1e1c844965a6f9bfb22c85f7e7e7084742e63451e1123a84bf5f3710bdbecacd6ba5266c0e

    • SSDEEP

      3072:rtzYy2mhLtNn5sakzf9FxarqOKP4IZ8+:rtjnnBkxFWqOKP4

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      AVFunnySpaceCtrl.dll

    • Size

      69KB

    • MD5

      9de56379c2d49a9c462fa1b625ab2e7b

    • SHA1

      da9865880826b2239edb25b99dce878ed998fbdd

    • SHA256

      a45d8d80208851f3ccba865bcbae485191b3fd001667d5832e3ad0bb15a94e59

    • SHA512

      d1fc81187a25c0c1fe0c57ced20e2604caa758b6eb14de125d9a1eb25579c935a94b5aeb9e6780108fc442910622023199716d84a48d23b7d8ec3be8b9a25b4c

    • SSDEEP

      1536:hDetKZDcAQq/QJn4DMXaRvwYAV3limort6P1sIN6oE:5hZoAroqDMX0wYAVwmQt6P1sU6Z

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      AVOrganizerCtrl.dll

    • Size

      164KB

    • MD5

      8bef7df39f99bf0d6f9c7410f4ec0c49

    • SHA1

      149ec0017cd0fa2352d956fcad2d790d2b01c609

    • SHA256

      06f4d31e710d7facaba8c259ea908b0a3177eb6bbc286056a613969a96cab935

    • SHA512

      7df747b04274c8255bad67b640b34741692e9fcaef5edd742b1b836c3e1928ea27aa70d13701792ec1d4214c3d3dbc3865567eda0f89000391f91fa9d7955415

    • SSDEEP

      3072:ZEj89qawEibJju6gUQJOtOxO5IEaz5zOJ7VhlSEyZduMZCXNCUtRZVvK9EO2Gpel:+jIq5EibJju6bQmyiImThMJUtvVgEO9

    Score
    3/10
    discovery
    behavioral29behavioral30

    • Target

      AVRegLib.dll

    • Size

      88KB

    • MD5

      dbb9961544ebfcefcb117a301bb3946d

    • SHA1

      e28a7c48066a7f30ef0a175f8c3170299c96d575

    • SHA256

      051866253dce9caf89d9a853e4522e6cf12221f4ef32118f27a669dcef529eee

    • SHA512

      e65745878013014096d66a5248c69a709164c425e2d75f834dfe13e18ffcc42c083946c1ce27181a46ec1ca2620896e9e5892e489d40d97b42110bb2542b76df

    • SSDEEP

      1536:kQ0YjvPNoL1MhDJrYAZVjIf9BNZcYpyJrn2yUyUOKRHvCaA:yOhDNYA4f9Fxn5OKRH

    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discoveryspywarestealer
Score
7/10

behavioral18

discoveryspywarestealer
Score
7/10

behavioral19

discovery
Score
7/10

behavioral20

discovery
Score
7/10

behavioral21

discovery
Score
7/10

behavioral22

discovery
Score
7/10

behavioral23

discovery
Score
3/10

behavioral24

bruteratelbackdoordiscovery
Score
10/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10