Overview

overview

7

Static

static

7

JaffaCakes...f3.exe

windows7-x64

3

JaffaCakes...f3.exe

windows10-2004-x64

3

Apply.exe

windows7-x64

3

Apply.exe

windows10-2004-x64

3

Baidu-TB-ASBar.exe

windows7-x64

7

Baidu-TB-ASBar.exe

windows10-2004-x64

3

$PROGRAMFI...er.exe

windows7-x64

3

$PROGRAMFI...er.exe

windows10-2004-x64

3

$PROGRAMFI...ar.dll

windows7-x64

7

$PROGRAMFI...ar.dll

windows10-2004-x64

7

$PROGRAMFI...rX.dll

windows7-x64

7

$PROGRAMFI...rX.dll

windows10-2004-x64

7

$PROGRAMFI...er.exe

windows7-x64

3

$PROGRAMFI...er.exe

windows10-2004-x64

3

$PROGRAMFI...rc.dll

windows7-x64

3

$PROGRAMFI...rc.dll

windows10-2004-x64

3

Codecs/Avi...er.dll

windows7-x64

3

Codecs/Avi...er.dll

windows10-2004-x64

3

Codecs/CoreAAC.dll

windows7-x64

3

Codecs/CoreAAC.dll

windows10-2004-x64

3

Codecs/CoreAVC.dll

windows7-x64

3

Codecs/CoreAVC.dll

windows10-2004-x64

3

Codecs/FLV...er.dll

windows7-x64

3

Codecs/FLV...er.dll

windows10-2004-x64

3

Codecs/Haa...er.dll

windows7-x64

3

Codecs/Haa...er.dll

windows10-2004-x64

3

Codecs/Haali/avi.dll

windows7-x64

3

Codecs/Haali/avi.dll

windows10-2004-x64

3

Codecs/Haa...de.dll

windows7-x64

3

Codecs/Haa...de.dll

windows10-2004-x64

3

Codecs/Haa...ib.dll

windows7-x64

3

Codecs/Haa...ib.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_2a322d5874b626864489bccec81da3f3

  • Size

    4.7MB

  • Sample

    250227-c5tnhsspt9

  • MD5

    2a322d5874b626864489bccec81da3f3

  • SHA1

    aa4aa7a8aff2f27abf92fe472cc63fdef9d92edd

  • SHA256

    4fbdde800542ed7446db9a2a87ee0da5a8479f547779aa138a4d3f5a17343677

  • SHA512

    2d677dbae72a188ccac49b4dab33119ad167413cd7f8387011433c2994a96bfa509692c5f8d7ac5c7bb4af3c724d572ed0e07f25022d3fde607c6068589c92c3

  • SSDEEP

    98304:PdHAq3a+3JEGTsqZiNfdIuh3yg49fZbRHKUgzSJpY35BGXDyL7aj5zs:iq3j3Jj5iNfdIo3yg49ftRrgenY35BGW

Score
7/10
adwarediscoverystealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_2a322d5874b626864489bccec81da3f3

    • Size

      4.7MB

    • MD5

      2a322d5874b626864489bccec81da3f3

    • SHA1

      aa4aa7a8aff2f27abf92fe472cc63fdef9d92edd

    • SHA256

      4fbdde800542ed7446db9a2a87ee0da5a8479f547779aa138a4d3f5a17343677

    • SHA512

      2d677dbae72a188ccac49b4dab33119ad167413cd7f8387011433c2994a96bfa509692c5f8d7ac5c7bb4af3c724d572ed0e07f25022d3fde607c6068589c92c3

    • SSDEEP

      98304:PdHAq3a+3JEGTsqZiNfdIuh3yg49fZbRHKUgzSJpY35BGXDyL7aj5zs:iq3j3Jj5iNfdIo3yg49ftRrgenY35BGW

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      Apply.exe

    • Size

      289KB

    • MD5

      dd9e51bfdd0df20be380a0920a082832

    • SHA1

      2135ba980f995328689b699ee04d15b901931fe7

    • SHA256

      9512dd5f507c5aece8a875b5ec6941f106d031f670efcfa516724b8af335b37d

    • SHA512

      d89c1711b28a307f3019d0e13822ae8ee7ce17feb7b50a7a127f4e6b74407717675a7e18e9af37c14e0c34b6f4bbaf6154caf9c7b404d71612f16d1c7d2b6047

    • SSDEEP

      6144:Zpz9LJHu10XQ8weW+L5JY+RwUtDKYHt5DRhy1ZPIrc20ElD:ZfJHu10XQ8w93+RwUt+Y1NrtplD

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Baidu-TB-ASBar.exe

    • Size

      1.7MB

    • MD5

      424444bb9df402afaa5d6f4192a2d6b1

    • SHA1

      d6276ad753aa55af08094226cdb3e8c6e05f659a

    • SHA256

      907386b1d5c28e5b994a14335b64dd508292e2fdb7fec38ce031a750f107564e

    • SHA512

      baf4294525564754c5d2191cf9856fecbf3e6444bcc5d3c36a9e8f054c6c4d25afd7e37414d9b93bd0abe21a2b88c66a7cf309043b53160616a68b213b253d24

    • SSDEEP

      49152:U9OO1/OTzu4c0Vm2R9y/aFt8vsUb+0tkOci:U4cOS2T9y/aFt8LFtkti

    Score
    7/10
    adwarediscoverystealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral5behavioral6

    • Target

      $PROGRAMFILES/Baidu/ASBarBroker.exe

    • Size

      131KB

    • MD5

      0c0d10f50bd70f50851f9028dcbab561

    • SHA1

      6590eaeff686c15c269e2697eb07a96b0eefe125

    • SHA256

      68d6c9464decad7deeaf6fab1fd203cd64a8ab26093ac613999e3042e3c83d90

    • SHA512

      159f2e006b1f166525a0b9197083673ead801c7625d68d73ac93e4b28a20db0742ed612728fc3088815fb6a749de0065e88e6755293faebaaf46d9f183b5f90c

    • SSDEEP

      1536:R+4yiwujgLVFsP+TCwXCqm5vb+cNCZkBfT3ol9t7tG2Tn+wZ7nzrNPTJdSp0j:pdwusDXUfvbhNCool9t7tG2T7Jz9mK

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PROGRAMFILES/Baidu/AddressBar.dll

    • Size

      1.1MB

    • MD5

      fa01bb721c480a3b08a76cf811812b07

    • SHA1

      d3e2703e86d56a67290005de12812f37d45ceb18

    • SHA256

      f02c847b82ea4bf98f214020c0d61f2039f6972e043b7502ee3c7b864687a6ff

    • SHA512

      4e678b4426963c012ef4db7231dbe2199546f82cf71ac7d800cf56873779ad2b164329b5173c09249f422c60b6fa580c135b9141df08a13c0b8a06d9fb07ff91

    • SSDEEP

      24576:cbiJjajJVPrp7wIb12unpi6jCwUvgRVzpdkfNWtTcvrBl7zTP:cbKjaLlwi1/HdM4TcvVlHTP

    Score
    7/10
    adwarediscoverystealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral10behavioral9

    • Target

      $PROGRAMFILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll

    • Size

      2.4MB

    • MD5

      e9e1884c564283e30e3f856d1f9f8f80

    • SHA1

      6200823787f1a1c6acb2b687e620dcc26eb1f3f0

    • SHA256

      4b2a125d3d19ca691e4ef46dda0b290a6d3cdbd58e35728148fa43da8ef52f0c

    • SHA512

      a0fadb771e3c8a26ae81d790ce07642981232f205af5576e4bbbb0ca29993f0f98b64a1f51868ebf58a7d6bb4ad491821525d299b5ba2c81c8a3ceb1a5745c3e

    • SSDEEP

      49152:R4OPX6ZEGjOO7dL/GwcD01BsAigR/fYTULeh0soClqYktY:R4O/6WGjOO71Gr0TsAiZ0tCl5n

    Score
    7/10
    adwarediscoverystealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral11behavioral12

    • Target

      $PROGRAMFILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe

    • Size

      230KB

    • MD5

      d46c87577e5793173113750ac106bf82

    • SHA1

      c7667d96f7f40a8c7f962bc041416ed0a9eaf028

    • SHA256

      5326dc341619708246cab00c1b5eac442b49434b33ee38abb4e08bb0beac2d43

    • SHA512

      08e50e0c7160227f789950f1ad306a7643d9033331ed6b8bc71e3468aaa80904d89be34a0369115b643f051808522297015d7b6b80e21588f4fd2177cfdfa53a

    • SSDEEP

      3072:hr4/Tlc851xgzl3qbyO5mHebtLcFHgsSEHyTBflg9wHxTtZOacJz9N6:hreq851+NZN+btL0H7HyTBNMox3OA

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PROGRAMFILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll

    • Size

      498KB

    • MD5

      14e54c67ae4c4a9c611e6e0e9e9d8352

    • SHA1

      f9b2846e9813027bd1f4d04d1f2760170277c095

    • SHA256

      9f0b741ac6046f05bc1eae34bdf5347abab4c59f3a4de56027e46c7f60066574

    • SHA512

      4d3855b3854bfa9dbcee443661bf4416c4f6272eb74f8edb10df5bb1366e98afec4055f6a86a501d985a3e9de8b48f5f5aa8ee5b6285bc22dd374f26a2d262ca

    • SSDEEP

      3072:HekGhjtLb/RwMcLWOWHxm+bcunGuV07j0hpFRcjeRDIVQ2SPUG7dcliVs1UGuTgC:+FL6VunGuij0hpFF2S97dVGbdrVnWau

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      Codecs/AviSplitter.ax

    • Size

      368KB

    • MD5

      4c7600d19df8b30f581f54fb3176eefa

    • SHA1

      fee752561c2f8a20875d56aece1616ff5587c42f

    • SHA256

      a2be7e9301e20300999d3f4478d68d2374afd2b9be9d165b28147c155d6b7cae

    • SHA512

      c8ccfd2c89fe8734731a5b86123d387f7003dedb5cf5a1aec8ac5870ec7d2c0ff07450c903f721623776b6ca3383a6c44884f8452e9166f0ab5b2b86bdf33ca1

    • SSDEEP

      6144:1MRw/EFmGHGKXUEFPA6ntSdaGe4AGhPCcVljdQyPToD5uKwopd:YWenHGKE2txGe4dTCwoL

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      Codecs/CoreAAC.ax

    • Size

      312KB

    • MD5

      b0ffac757be8d6cc41e1131eb2b0d959

    • SHA1

      0e41733a050bc2ed53fda6337d6501b9942317c2

    • SHA256

      04bf38bbd9cb8287582f9a2fb8b06e0ab30f06f676a93f4a56656b576f10e597

    • SHA512

      356ecf4902f767f74670e5fcd57f26fb8a43710d0a2b3a995877e6f265119b2f091c6e5e3457dfa1767c6e4043afc470cc7090f43dd997b27c0e94c7e102bee3

    • SSDEEP

      6144:+yTbEUUmDAh189YEqbBpkJzJTba96sZTiaJfOMBfcESToVk:bxUmDAn4C9GBJba96sZTf9Oy+Wk

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      Codecs/CoreAVC.ax

    • Size

      265KB

    • MD5

      a45cfb1f058297ae981f8afeef056b8d

    • SHA1

      e454ed585a0f19d3119cef725958ea19c93cd7cf

    • SHA256

      779768aa0bf2270422e1686547ae622238e7b7cf37ce212a1d75caf8628c1508

    • SHA512

      efa87c97e4f76d5fbd73d2e0c5c580c719518d4e3e7e16efdb1355b659c9584956bc7df944f0d637f069f359a046fe65bfd178e4cbaf97fbb5921ebd29e09aa0

    • SSDEEP

      6144:/+x+B++xX1f3uZINBKD5wlA9amB38sDFe9E23XbFDZ:Wi+A1fJ2wlhmKsg22nbNZ

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      Codecs/FLVSplitter.ax

    • Size

      376KB

    • MD5

      0bfdc3410a7edfbc05414cce6f76958f

    • SHA1

      e70ce8d63394c4e48a3f2d6ec467db3ce801f988

    • SHA256

      4781757e283f44bb5d85bf8600e89a2483d0742b13a02b446005dcb02a72d9b3

    • SHA512

      6df1bcee3b82b451f4098e05b9335824ffeb1239cbe67003b053473622d2360e7a5e03173dae8ff7aafdd4f959a39e73a68e291bff4f0d5824688e1b8b39b097

    • SSDEEP

      6144:h9hcFIuTT6v9VyUgf10zCpN138+VRjWL09y0Ur6ebjZDkjYOE:hruIuTT6uUWnN2+V5Py0CjyYOE

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      Codecs/Haali/Haalisplitter.ax

    • Size

      540KB

    • MD5

      c8534d058ca2ceb3724296ac1074c18e

    • SHA1

      0c3dcf98d5ce9d064ef2e22cae554a203af10c68

    • SHA256

      5ce60a851d91d3960f350c8a73ccd2b3b95569af514d7031bdfcb216aab65e6b

    • SHA512

      c02f515ff2d6e8cc481fd443839d4b0839fa8f1453b823633c5c1e2ef1effc2e9f9ef33e682d98453db3fd613d63a89da6ee00db075c0e178f5ff72ab82614ff

    • SSDEEP

      12288:7PYw+5YwnUcduPa9iBGNag2IExyiFjgf4EMvT:L73cd99RNAIExxFW45vT

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      Codecs/Haali/avi.dll

    • Size

      107KB

    • MD5

      3d8cb43c65df8c33263fdc0218d13877

    • SHA1

      7ee6a0fe92d9d3cf57681b64e1363664714f3aaa

    • SHA256

      2080b28442182ee3cf0568140282245430d596ba7a401a3fa220b2d7d97f7bd2

    • SHA512

      a10ccc4f33b654f80816e7325bde22c851e36f0dd1eeb16af210504791d412d3e1f0b91f1c42d1cbb94e1c11967b8fc5297d67d65472f839ec2b9ecab74776bf

    • SSDEEP

      1536:2/JbhpdNtU2ndl7owJG3+7loyVczH39oEtunktv8HXFflOOSKQz4N:EJbd/nfpJGMoq6Hto4z4XFfIODQz4

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      Codecs/Haali/mkunicode.dll

    • Size

      24KB

    • MD5

      490d0887ea96103cc25595a1e5062f70

    • SHA1

      17a8519b00cb5a360dd18cbec28fdb16b9edb84d

    • SHA256

      5e7efc26bcaa4ee3f89741d97ec7f22695da13d9932ccd01e777f0580c835b38

    • SHA512

      27654dca5b21ff3611c9c902e1352d01fda751f753d501972f0d4ec916246472e9a4a13fe4331cdf483fada8612a84a7e9e75099cbabe97ca433e38fd2dc9a05

    • SSDEEP

      384:ohAVJc5nTawOsIoy3qtiB9DRPnoDtaYCV6YxJde9UnV+gn3tj:+H5TaKy3qYnmaYrKV+U

    Score
    3/10
    discovery
    behavioral29behavioral30

    • Target

      Codecs/Haali/mkzlib.dll

    • Size

      78KB

    • MD5

      a09e606469d3976fc4be96736c7d2671

    • SHA1

      b85486b3a4ef6fe84fe5a7e16878ee09a04b066d

    • SHA256

      6d057b4fde46a5dd0550b73989011a050eb12868dda30787ad3673e569dc6d11

    • SHA512

      611e9ee2396bd3449d0bb143dd02a844935624a474c6ec50289b70b2f69d5e603d900fc4274d7439e92bc3453e1ff8f6464dd483d31c45d6944dc16e5cc5a4f4

    • SSDEEP

      1536:c+DFEuj1NkXaMyuWqezcTo8SRlGIIObnToIfFT+aG:VzgX0zcelGO7TBfFT+aG

    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

adwarediscoverystealer
Score
7/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

adwarediscoverystealer
Score
7/10

behavioral10

adwarediscoverystealer
Score
7/10

behavioral11

adwarediscoverystealer
Score
7/10

behavioral12

adwarediscoverystealer
Score
7/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10