10edde210eefd23e8e0d6a35d063c1d08b56ff40a93a03cf8031e86e48858f5d

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__2ab56410a4009f953335448e5464c97d
Size 159KB
Sample260920-3lencsvwf1
SHA256 10edde210eefd23e8e0d6a35d063c1d08b56ff40a93a03cf8031e86e48858f5d
MD5 2ab56410a4009f953335448e5464c97d
SHA1 18579ef528f4a01441928d32827c5b6f6d121015
SHA512 36ee634ddd9ff2d4d0ad50582da997d0abc5f80a410ec947fa2beb11603446eb0da1bb753fbfa2c599ffb679f8673760f29488f740c6b8175ce8965f03daa512
SSDEEP 3072:4ZMJnTeM4cJJxtSJcfTS7gig+jyxDYvGw79/bBOuNQkIE94Sm3oG:UeTeM/rSJki/jyRYu2/bckIRSkL
TLSH
T1F4F3026176C888FBE9AA43B166F7F62BF2FA6740131021535B70AFAF3C30147991E651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  jaffacakes118__2ab56410a4009f953335448e5464c97d
- Size 159KB
- SHA256 10edde210eefd23e8e0d6a35d063c1d08b56ff40a93a03cf8031e86e48858f5d
- MD5 2ab56410a4009f953335448e5464c97d
- SHA1 18579ef528f4a01441928d32827c5b6f6d121015
- SHA512 36ee634ddd9ff2d4d0ad50582da997d0abc5f80a410ec947fa2beb11603446eb0da1bb753fbfa2c599ffb679f8673760f29488f740c6b8175ce8965f03daa512
- SSDEEP 3072:4ZMJnTeM4cJJxtSJcfTS7gig+jyxDYvGw79/bBOuNQkIE94Sm3oG:UeTeM/rSJki/jyRYu2/bckIRSkL
- TLSH
  T1F4F3026176C888FBE9AA43B166F7F62BF2FA6740131021535B70AFAF3C30147991E651
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer upx
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
- TLSH
  T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PROGRAMFILES/Funshion Online/Funshion/m
- Size 100KB
- SHA256 90e72a0fa616838b90c965623ece3f2a73e1af308e16ae7ae252e7b1e48523ae
- MD5 2086d23ca74f007a5426a4316b7347a9
- SHA1 d368983f7c59a7130e78541dd899e63f0cf02e03
- SHA512 b6c4041524ed529687e5b0548c1f6a9601cd01aacc294827deca203b48fad9742daa6e1c0587fe1523e846827f1e65fab51b790d31554cbd1fdac71ca8be427d
- SSDEEP 1536:WyZMSZFvknTePMZd4k4kJJM4Romu/G7HVtbVt+gTXBUZ0r/UxVzef6i0lixG/HLt:xZMJnTeM4cJJM45TjVhDOZnxVayrrdZJ
- TLSH
  T195A3E12233C0C8B3DED505B29AB74BB9A3B7DA081350A9171F350F7F2E31187A91A1D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence spyware stealer upx
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  $PROGRAMFILES/Intel/RIZukU.exe
- Size 11KB
- SHA256 487074ddb2b5b892b568cbaaa8b6349af983405f66404347d99c20e3e4adf7b6
- MD5 5efe54ee4f3778e7750df60186a099d1
- SHA1 1bdb4b9ce2be480e78d886b7cccef781e59de40f
- SHA512 387caeae75d72fc71160ada3371ae73101af531aa44a7b17ed6e000340f3b08f182661d9e42436aba16667d95327e524058f2bbca48c7dc658e731c3b63d6667
- SSDEEP 192:SezFy0JIZgAtxlw/OQoP1hscuLhBifFSIfqb9D:FzU0CZgAtbwN81hscuitb4D
- TLSH
  T1A8328D51A7B75016CCE285385B73861B9834BC724E2FA68E1E143E2D6C707E0E93D3B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

bootkit discovery persistence upx
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  $PROGRAMFILES/Windows Media Player/qoue.exe
- Size 12KB
- SHA256 b53902563544a6f013600d5d5d92d2ba0d05c86e91b28936dda820dc772b39e9
- MD5 34e232ba20124c720efbdd661cc67cd3
- SHA1 7436834ad99c811c05748726e4a5ad08bb7d1836
- SHA512 0d80e925fc7cf52a32aa4d2c5fc8d3e7f6e422198595974e48cd88376e9a09d748aacd38ad9331b2630911bbe3cb644d72c83b88c1f51944d9ebc545a20d44e5
- SSDEEP 384:i55CBZYz3rDIs1jvEoIILAPBjFtwvcXCbUd57:ifgZQbMs1qIQFFNy
- TLSH
  T14142B09B3B4C4E62FB8AC37E0F0B53299B7F10E9E7D59028FEAC02A52C466741234545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  Hash-MD5֤.exe
- Size 28KB
- SHA256 33f9ff6f0ef8204500383a70ac2cd3381ad3fd1e94f99d8b8b75ba196a443d65
- MD5 1adbcff9fda7150c2c41ec27a779e41d
- SHA1 532dc17c67a6de676340c6695df59860229ef820
- SHA512 a056897d5e1717e881d61eec66edab81a17bc6ae8dcaee07f5637eeeb7fc842b62c0508f0b34e9315bfd3872fb40b2296e7697b8a12af9d23ee5fccba7089ff4
- SSDEEP 384:Zgaq3bc4ivsSLzwG27W6k2TzFtwX7ryFsoqN1XA8E3wH4MZd9R41PJxBSUefD:qaq3bc4ivsMwUBLrZncBxBSb
- TLSH
  T1E6D21A896BD71A91FB631F7E0267E92F8311EAB40B24D2D3BB528F8289302D15C752D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  uninst.exe
- Size 33KB
- SHA256 744f8847f96d6c1e1fcb0ef0cb6714d1fa287acf465c90a9643c3e3d5de5ab47
- MD5 681f025c5d03e74b5d200300f2927a07
- SHA1 336161a0e1b1593711fb097f495c9b4b4b88fbc2
- SHA512 c4279036db2e8879755e19adfc3e0ad24632f69eac38c778285602e2586611633da567a078faf4cd07bbe1c216d42c9b14685d6f00f7c2f7e3ac0a36d917d456
- SSDEEP 768:phMZ0dF4ZFvQbn+eePu3cIQGCGbiC4k42M3wJJdgM:pyZMSZFvknTePMZd4k4kJJdgM
- TLSH
  T1C6F27D5736D088B3D99706B117B7DB3BE7BB93001310625B6B645FBF3D22287A91D282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral13 behavioral14