745df2276ba62f3951e9c5a78a95360ee1f94e68558191a9c2ef424cdd8ec778

Sharing

Copy URL Twitter E-mail

General

Target
jave.zip
Size 36.2MB
Sample261002-g4xe8ssapc
SHA256 745df2276ba62f3951e9c5a78a95360ee1f94e68558191a9c2ef424cdd8ec778
MD5 ad11a0647fcbf3433fe9fa9582b8f49d
SHA1 83322c3b4a13e2303ac544fa1d620ae46fecc6a7
SHA512 a6637c09f63043aced42eb10ecf4bcc287cccb52db358c66cf4e4e2cdbb8bd887187fb4781fdb9f0db6214aa3d42a6e6a33a914095f3f7f0ecb3e74aaec00893
SSDEEP 786432:vugmqcL7nkG4GzXUSBBXrHbRfVSNsLS9alOy1VKChKiy5O958uuDArx:2gmXL7kfGDUSBBXrVVe0X1EAKidHFyA1
TLSH
T1508733AD964C2924DC249BBB541767867FAC29E27081C7781768A0D18DFF2E4DF103AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jave/1stinstall.exe
- Size 45KB
- SHA256 8c9b58c91a712c6bd1fe081b6b64f064ed196fec8ee96ef23aecacb82854ac46
- MD5 d86f72ea396de2ef24fadf8a4c8870ff
- SHA1 3f372bf319c476ebd075720ca974bd0302662e20
- SHA512 e0b9464bbb89245dd1e979c1a6ca54441648b457f62e8dfa6765b5ce9980592e42466e62942d1e122bc2cb29268b0ae8912f8b1e327395ee7c06515a3830c5d3
- SSDEEP 768:Vpm7BcEKNvBcvL6VeRNL1a6ZO4PTPz+o+CKr3zQ4NuVVWgP4+z5CzpgnbcuyD7Uv:VpfEKNCj6VoJl9Go5K7s4Nu3tnouy8
- TLSH
  T15723E147928DADABEA2460799C5F1C699F9CD71C72808373DDD137BA5CA0B060F1D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery execution ransomware spyware stealer upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  jave/disy-commons.jar
- Size 1.1MB
- SHA256 4de8aaaa29ac3a759d9a1c44e0d57ac278fb79954de0ef2561c5d613e9307163
- MD5 96c3c912546c9d2c7f8679f23d95acaf
- SHA1 f03a02723eb652ace7fc4af06bf4de4b3f332c68
- SHA512 94217327fcc8128012d92d0124327423a89f6ababc060b52cf8fbb0ead2eabb49ca069b6840072709570c8b06ca7fd8dae8bb78cc96664a62ae9283435cc22b8
- SSDEEP 24576:4kyo6tODishrUXNDWkCAV7RPbSrlMFOd7J2lsDtZ:5D6tODiQraRB7Rurd7Usv
- TLSH
  T150457CA1A08D61E2D44627F26071B02F78391F809906B3D678F2706FF5FEC456BD8B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  jave/jane.v1.81.setup.exe
- Size 1010KB
- SHA256 f99cacff4ba70c2822a37c1a9b66143ce34463c07ca4da3399c5e041ea93e804
- MD5 7a1449b137c9971bab28684cbff87db1
- SHA1 9de7068fe34a583b291c335d02d275148307bd08
- SHA512 ac8388d6e67a9a0df0da2b34f5879f9e13c65002117784ca85b52ee5606df0302ba6b0c84f2428353c65a8a4849fdf86691fc2a4cb31a9b8a9ff922ba72897e3
- SSDEEP 24576:I4sT06gHMQFxcFyZh0wkY9EZvGaOcsIva7vtt1g1vT:Vz6gHt8wkl8aOCCbT1MvT
- TLSH
  T1192523A63240FA56C9711471E862D6F647A57CA3C2244387378C3F6D7E3BCC2D927299
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral5 behavioral6
- Target
  jave/jane/jane.v1.76.setup.exe
- Size 565KB
- SHA256 3f36125e7eff61da0b105f55cf7eb455c684786c296316f38354c945c2b1886c
- MD5 90cf3e4cb226913141ecbaeccc3b061b
- SHA1 70987253c7f681a2cc564065bd0144eb3e519a4a
- SHA512 a49712b735f5546bf3828fcf9d17d41a239cea9dd420b7ccc1b40abe1c15bd94a28c2c5275bd2a81d2b6e7281c093d1828beffc62a7753a031886c1bc5030703
- SSDEEP 12288:LEUqJ0KqCTxyEWSGMPXZUUHeM6jiUG+VG+ALqUsemidGIrHS+o:2JBxZJPZUUHeM6PAOYbHo
- TLSH
  T1CCC412243200D886D7A546B2DEEE66F89AC6EEB6C1054E8727D07F5E7C364D1D83B243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral7 behavioral8
- Target
  jave/jave.exe
- Size 46KB
- SHA256 bab8d70f4fb9023cd5e13c210879436c87aba329a6615dd732445f012b633e5f
- MD5 2e9c6dc3872be6fbd66878a28406abff
- SHA1 d5d020208743717de609032a3970d6d2c2ce4791
- SHA512 be8f3ef09fce1c7287b9119f66bf769b187477a8a0fd0683be5d730dcf5c0402606d1d0a3f0ce79b8156dbd53f6486871e0eefa254f451e442c9f1f637e9c56e
- SSDEEP 768:Kpm7BcEKNvBcvL6VeRNL1a6ZO4PTPz+o+CKr3zQ4NuVVWgP4+z5Qt8nbcuyD7UQF:KpfEKNCj6VoJl9Go5K7s4Nu3m8nouy8k
- TLSH
  T18023E143E2CC6D6BF56461756D2F1D285F5CE6187684C3BADCC027BA1EA0B054F29326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  jave/jave.jar
- Size 2.0MB
- SHA256 373fd4562308509e764afb018080570d160895cac929cd8663af433d6d46baf1
- MD5 f92e21ce8133e1d6e5d0dbdc2e75b4bc
- SHA1 8b119194c54ceeac2cf16f3ae5711d4355602b8a
- SHA512 ed36eb45d5147e95fdcdcfadf2d64a8703c88201ecf6f2c48863bd5d2eda6bf7f6b4b0827f8f146f753aede1d19a7e14b1607ea9e698dab68aa85e6689370933
- SSDEEP 49152:wBBLbKn5aWvf86unLptvMamTeuiT2qWIVcfasesMWh41XvFXxrkf:wDLun56pt3mTe7niflMH7hrc
- TLSH
  T1F3A5D026E9453263DE53D372914B71EA3C3D05B0E01BA22224A87AB77DEFD557BCA310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  jave/javeplayer.jar
- Size 129KB
- SHA256 8de5c3c8fc638d2ebe8f73c5d2930c5f1e39978d26f63cc8b3ff7af361d14147
- MD5 4c960bcb6bdd17e261e8dd1aab1bf490
- SHA1 f1c601bda75608c78612bbabb1f9c09d04949890
- SHA512 7763038cb626aeefcaf792af28a25e55c2331e78bcdc6f1752054074091efe782e70a72e0856602f28eee03201eb281da92d5d4a24ad9816fc6addebae3f9712
- SSDEEP 1536:Rgltx9vbH8oTTwl/tDD9LxkyIMTF8cUzds1SSS0GsJvIxBamxqjOrO7GNG:aLPcaT4DBVIyHUzds1SHFs14AmxqEwZ
- TLSH
  T13FD37D19EC558863D303827A2033A02C6C79D791A4C5E3D71EE4FA5B18A5DA52FCBDCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  jave/jre/jre-1.7.0_13.exe
- Size 30.1MB
- SHA256 6dfcfa2f97d790fc30e4f8a23443a2e4d98c121c2569b2a0c0c04cdabefb2f26
- MD5 fd6a76916408345e57b28c6afa5b9cfc
- SHA1 72ad271c6c7e7d1893a9661aad2854a75e87cd5f
- SHA512 82d3099c1e33c2c347053780ca0b33cacebbe08b1c14e107190343dcf81e8493641ae605f548f5d04eb5c809e89d023759d2f286e50616dcbba54e9c5fea1e7f
- SSDEEP 786432:OaEQkmgz8nvXpknzam56v8wN7/tNgkech+pFSUU9fY:8QkmgzKRknnITtNvec4F5kQ
- TLSH
  T14E672352F680B132E4A607300DBB8B59567EBDA46B7161CB23C9739A9FF13C319257C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery execution ransomware spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  jave/tmp/1stinstall.bat
- Size 920B
- SHA256 b8e379613c43e0e3c9d50b70463144a64080919a22ae883291ecb404eb89e11b
- MD5 8708358df5a6ce501819d745f1dabd8d
- SHA1 c88d2c1a57124fa39e6d4c4c6b6de78e3656f28b
- SHA512 3d18767464ca9f203e22f31896f037564d5e5b3a2d5e8d15cff401b3813e37e0c6553333f2f3fdfb3d33556e22e6689dbbd05664f7c442f5f6410bbcc58abd85
- TLSH
  T13311049D07D984465C955420C90D06F6C7C83F71B6B6F5B0D90A3CD1BB32A76CA7BD24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  jave/tmp/jave.bat
- Size 1KB
- SHA256 b74b3587521a14b1ca3417151a0fac047aed0f71fd4b0b2eac86d08153408821
- MD5 218bd5b885a9f08a7e6b0406c93edcf0
- SHA1 182f2fe0ed809d9e8bc3683621e2f221919c5b86
- SHA512 c6aa330621239e4dd1137f9d5b96e14b96bc9f773378d3705591533b535aa515a448505862b8f620a9cd93428f219faa93b515b4f495f25e147ac16fa112b681
- TLSH
  T15411029D1795488A18419820C90A45FBC5DC3F73A7B7F590D50A3DD3B631AB1896BD24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Installs/modifies Browser Helper Object

Drops file in System32 directory

UPX packed file

Loads dropped DLL

Loads dropped DLL

Checks computer location settings

UPX packed file

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Installs/modifies Browser Helper Object

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20