pykspa

General

Target

JaffaCakes118_8c09682f34406064eed9412de458e907
Size

476KB
Sample

250329-vpbf4szye1
MD5

8c09682f34406064eed9412de458e907
SHA1

4af9e5e945891a2a86abc95f8c49935c0b7d1d10
SHA256

5f272cc5a7816d99e32eadfec8fba293ab2ab9840806501b6f5ca2d041a82b13
SHA512

253120907b2f598204502da641f5da06062a5d0086dddee7b88a7216f26367a28de0c254ec2f3204f53e94a5008b1b4473f36507fc2ab7de389c6af17a99a6de
SSDEEP

6144:hj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionjf44:R6onxOp8FySpE5zvIdtU+Ymefr

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_8c09682f34406064eed9412de458e907
- Size
  
  476KB
- MD5
  
  8c09682f34406064eed9412de458e907
- SHA1
  
  4af9e5e945891a2a86abc95f8c49935c0b7d1d10
- SHA256
  
  5f272cc5a7816d99e32eadfec8fba293ab2ab9840806501b6f5ca2d041a82b13
- SHA512
  
  253120907b2f598204502da641f5da06062a5d0086dddee7b88a7216f26367a28de0c254ec2f3204f53e94a5008b1b4473f36507fc2ab7de389c6af17a99a6de
- SSDEEP
  
  6144:hj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionjf44:R6onxOp8FySpE5zvIdtU+Ymefr
Score

10^/10

pykspa defense_evasion discovery persistence privilege_escalation trojan worm
- Modifies WinLogon for persistence
  persistence
- Pykspa
  Pykspa is a worm spreads via Skype uses DGA and it's written in C++.
  worm pykspa
- Pykspa family
  pykspa
- UAC bypass
  defense_evasion trojan
- Detect Pykspa worm
  worm
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Hijack Execution Flow: Executable Installer File Permissions Weakness
  Possible Turn off User Account Control's privilege elevation for standard users.
  defense_evasion persistence privilege_escalation
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2