jaffacakes118_Trojan-Downloader[.]Win32[.]Upatre[.]gxgt[.]21e4ce87f46b41512a677ae5b196b20c

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.gxgt.21e4ce87f46b41512a677ae5b196b20c
Size 2.5MB
Sample261006-rdv5lazzfs
SHA256 4076cf4933627de58b9efced22074e40b68ac6dc62e09f7990c2dc15096c02eb
MD5 21e4ce87f46b41512a677ae5b196b20c
SHA1 e150241f2b1418e363d420d350b50502a1d2e0f9
SHA512 4acb47b118b01da660219f9e87347c59ef662bb7f13c2bafd3726deb2019f19de73293c1389bfe3ea96f102b6e8e3b6af3d6b8a7584c9d74dd5ea9f3777406c5
SSDEEP 49152:kkcPj/A16HXIiBM54hv962FFAD53wXVMpPdzMLi9SlUk4rUvbW/mLtEKytg815r0:kkcPj/A164Aw8NT03wlMp1bcbvSN3S+Y
TLSH
T139C5335B4BA66708C2312F3647F99BB384BE7A47601598841D3D6830BF57D36FB6A0C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_Trojan-Downloader.Win32.Upatre.gxgt.21e4ce87f46b41512a677ae5b196b20c

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.gxgt.21e4ce87f46b41512a677ae5b196b20c

.exe 2.5MB

jaffacakes118_Trojan-Downloader.Win32.Upatre.gxgt.21e4ce87f46b41512a677ae5b196b20c

IMPHASH 2eabe9054cad5152567f0699947a2c5b
SHA256 4076cf4933627de58b9efced22074e40b68ac6dc62e09f7990c2dc15096c02eb
MD5 21e4ce87f46b41512a677ae5b196b20c
SHA1 e150241f2b1418e363d420d350b50502a1d2e0f9
SHA512 4acb47b118b01da660219f9e87347c59ef662bb7f13c2bafd3726deb2019f19de73293c1389bfe3ea96f102b6e8e3b6af3d6b8a7584c9d74dd5ea9f3777406c5
SSDEEP 49152:kkcPj/A16HXIiBM54hv962FFAD53wXVMpPdzMLi9SlUk4rUvbW/mLtEKytg815r0:kkcPj/A164Aw8NT03wlMp1bcbvSN3S+Y
TLSH
T139C5335B4BA66708C2312F3647F99BB384BE7A47601598841D3D6830BF57D36FB6A0C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

81:bc:49:1f:18:93:bb:4e:8a:09:1c:85:46:66:01:32:7b:8d:ba:bf

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Telegram Messenger LLP,O=Telegram Messenger LLP,L=London,C=GB

Chains

Mar 25, 2018

CN=Telegram Messenger LLP,O=Telegram Messenger LLP,L=London,C=GB

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Telegram Messenger LLP,O=Telegram Messenger LLP,L=London,C=GB

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

1b:e7:15

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2014 - May 30, 2031

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

07

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Telegram Messenger LLP,O=Telegram Messenger LLP,L=London,C=GB

Serial Number

84:cf:3f:73:ed:b1:0d:86

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 9, 2016 - Sep 10, 2019

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

07

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Serial Number

ef:95:c2:f4:80:e3:1b:93

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 14, 2017 - Nov 14, 2022

Minor OS version

0

Major OS version

6

Entry point

6770688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

165KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

jwgjqzav

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ijdmrzgu

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

jaffacakes118_Trojan-Downloader.Win32.Upatre.gxgt.21e4ce87f46b41512a677ae5b196b20c

PE Signature issue

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.gxgt.21e4ce87f46b41512a677ae5b196b20c

PE Signature issue

kernel32

generic