pykspa

General

Target

JaffaCakes118_8a01bcb09b024896cdaf5a880dd8a094
Size

600KB
Sample

250327-yknsesyry4
MD5

8a01bcb09b024896cdaf5a880dd8a094
SHA1

fa6c9c41d673cc567b909c304380b166538f964b
SHA256

1245110ba2ca69fa0e47a45237891925276be818ea7e0bb1a1ed92f4a610b004
SHA512

6656722e386ec828b9b135110882da1fd2a513fd2df5fda04e28a41d6aa165dc189f71e43783a679ad86b4d42bc4631a0cf0602ad5ede30bff0f8fabe6e89d9c
SSDEEP

12288:s6onxOp8FySpE5zvIdtU+YmefaRfMMMMM2MMMMM:Qwp8DozAdO9aRfMMMMM2MMMMM

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_8a01bcb09b024896cdaf5a880dd8a094
- Size
  
  600KB
- MD5
  
  8a01bcb09b024896cdaf5a880dd8a094
- SHA1
  
  fa6c9c41d673cc567b909c304380b166538f964b
- SHA256
  
  1245110ba2ca69fa0e47a45237891925276be818ea7e0bb1a1ed92f4a610b004
- SHA512
  
  6656722e386ec828b9b135110882da1fd2a513fd2df5fda04e28a41d6aa165dc189f71e43783a679ad86b4d42bc4631a0cf0602ad5ede30bff0f8fabe6e89d9c
- SSDEEP
  
  12288:s6onxOp8FySpE5zvIdtU+YmefaRfMMMMM2MMMMM:Qwp8DozAdO9aRfMMMMM2MMMMM
Score

10^/10

pykspa defense_evasion discovery persistence privilege_escalation trojan worm
- Modifies WinLogon for persistence
  persistence
- Pykspa
  Pykspa is a worm spreads via Skype uses DGA and it's written in C++.
  worm pykspa
- Pykspa family
  pykspa
- UAC bypass
  defense_evasion trojan
- Detect Pykspa worm
  worm
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Hijack Execution Flow: Executable Installer File Permissions Weakness
  Possible Turn off User Account Control's privilege elevation for standard users.
  defense_evasion persistence privilege_escalation
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2