5b2268dfb40fc2f37f2b338c0511b629ea3fa3c1ffc069a193be5e7476504e46

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__6ddcef131154ebf4843161cf11c72a3a
Size 1010KB
Sample260919-gjbyssca25
SHA256 5b2268dfb40fc2f37f2b338c0511b629ea3fa3c1ffc069a193be5e7476504e46
MD5 6ddcef131154ebf4843161cf11c72a3a
SHA1 139dedb0697382fb5acee003472969ce8cb9d694
SHA512 13bbf957e507de33258be7685d940202321cf14194f2513246a2e77bf4ea6c8f90c1b64f216567b956d6bc6b72abee3c38b11252e5b76006575ac4039d5c27fb
SSDEEP 24576:VSPz6gtnqXtnr/AwQOdOwRVlN3L1qC0EFl:Ozj0XZTOwvn3L1qEl
TLSH
T1D5258C42BAF1C17AE5A342700D76C719A672BD955B3586CB73C03E0F7E312D29A3A316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jaffacakes118__6ddcef131154ebf4843161cf11c72a3a
- Size 1010KB
- SHA256 5b2268dfb40fc2f37f2b338c0511b629ea3fa3c1ffc069a193be5e7476504e46
- MD5 6ddcef131154ebf4843161cf11c72a3a
- SHA1 139dedb0697382fb5acee003472969ce8cb9d694
- SHA512 13bbf957e507de33258be7685d940202321cf14194f2513246a2e77bf4ea6c8f90c1b64f216567b956d6bc6b72abee3c38b11252e5b76006575ac4039d5c27fb
- SSDEEP 24576:VSPz6gtnqXtnr/AwQOdOwRVlN3L1qC0EFl:Ozj0XZTOwvn3L1qEl
- TLSH
  T1D5258C42BAF1C17AE5A342700D76C719A672BD955B3586CB73C03E0F7E312D29A3A316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  $TEMP/Set-up.exe
- Size 793KB
- SHA256 6be35fe8543aecfe21ece4a1077373a760e6d22012b32fb19a7a53ef15445b3d
- MD5 9209338186015547dc9cd90258da09e4
- SHA1 a6f17d98b85ae07d2962296a25a9e04f35463dae
- SHA512 d7fb31b050dfa7bf31bcdf35650076ba431aca2af293efa0ff85936c387ed70eacb05820b796130b8d7e35307b7a217c1b4eed20298e1c53ed272f19c37855db
- SSDEEP 12288:C/AwQ9izQ46IOwAyKm9vRlN3LUcqC0EWUl:C/AwQOdOwRVlN3L1qC0EFl
- TLSH
  T194055A41BBF1C17AE5A346704D76C719A672BD915B3196CB77C02E0F3E312C29A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/svchost.exe
- Size 154KB
- SHA256 0bab3a2fafdfd026026ed1f3e689febfff17e61d7f1c23501a5accebc8300119
- MD5 024a2fbda97eeed3d5ee557739760c60
- SHA1 81f98ba5358b08eab4b83937306364b9160a69e9
- SHA512 e0fec6e5cb70f3377c5995ed532c29765e98148fa9892707c72614392b557a50d3cf5fb20932443b166e2be09950b2aa77d899c34a36339c508e8d7d1e6b154f
- SSDEEP 3072:bgXdZt9P6D3XJT6bFQP5Kyx3tnviuD1AUlSjRtVkk5Kyx3tnC:be34d6SUyZtnviu1AKkUyZtnC
- TLSH
  T162F3F19691D25857D4D603306A3B5735B3B18EDD4360918317BC7FBA0FA63A3CC2AA92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral5 behavioral6
- Target
  $PLUGINSDIR/NSISArray.dll
- Size 19KB
- SHA256 6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
- MD5 14b848866035dea39b912da628307231
- SHA1 d00c8963aee8038d8a22f098cef69b31007196e5
- SHA512 4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
- SSDEEP 384:J+o6oNJDOD4mqjCQ2UcW3++Mnnm8GPHltUIH4qpjiX:gDoNJyD4mqjCOsnmtHltUIYqFi
- TLSH
  T14A92D9BB4710A4F0D37E2879FBC99A1F897E311064A5D4E7CB775F898F1014A1B76212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/blowfish.dll
- Size 22KB
- SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
- MD5 5afd4a9b7e69e7c6e312b2ce4040394a
- SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
- SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
- SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
- TLSH
  T10BA2AE87D9E0CC71D1DADAFB4E92D10DEBF235302D8A151875FA2CCB489B2D70A1C656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/md5dll.dll
- Size 6KB
- SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
- MD5 0745ff646f5af1f1cdd784c06f40fce9
- SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
- SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
- SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
- TLSH
  T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  messenger.exe
- Size 91KB
- SHA256 66474cbf47bf554c5bfdd62ea39b864096667fbb7d77c5103eb874e0c81cbe97
- MD5 fc6e4175f214b4cfb15504d6c43f5e66
- SHA1 fba7ae4e5ee7a5c13e37688856abe8052469f788
- SHA512 ecc99c27c9f8c0f0edc0a6f87119675725f7028b86f27c1ee53169ec29c0f406b1cd1ee43b655dd62295a71bef012e61fdc23eef845d0f82c10a3f07fcac741f
- SSDEEP 1536:hpgpHzb9dZVX9fHMvG0D3XJHZzkF47BLPkqIzjbanya/x6s+bMnb:bgXdZt9P6D3XJ5zkFQP5Kyx3tnb
- TLSH
  T10793E056A1C148A7C9D6033065B7A739F3F6C6DD03A15A430BAC3F7F1D21293CC1A6A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/NSISArray.dll
- Size 19KB
- SHA256 6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
- MD5 14b848866035dea39b912da628307231
- SHA1 d00c8963aee8038d8a22f098cef69b31007196e5
- SHA512 4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
- SSDEEP 384:J+o6oNJDOD4mqjCQ2UcW3++Mnnm8GPHltUIH4qpjiX:gDoNJyD4mqjCOsnmtHltUIYqFi
- TLSH
  T14A92D9BB4710A4F0D37E2879FBC99A1F897E311064A5D4E7CB775F898F1014A1B76212
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/blowfish.dll
- Size 22KB
- SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
- MD5 5afd4a9b7e69e7c6e312b2ce4040394a
- SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
- SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
- SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
- TLSH
  T10BA2AE87D9E0CC71D1DADAFB4E92D10DEBF235302D8A151875FA2CCB489B2D70A1C656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/md5dll.dll
- Size 6KB
- SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
- MD5 0745ff646f5af1f1cdd784c06f40fce9
- SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
- SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
- SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
- TLSH
  T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

ACProtect 1.3x - 1.4x DLL software

UPX packed file

ACProtect 1.3x - 1.4x DLL software

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24