jaffacakes118_Trojan-Downloader[.]Win32[.]Upatre[.]gxkz[.]914118adce33096f09f61dc7c4786319

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.gxkz.914118adce33096f09f61dc7c4786319
Size 2.8MB
Sample261006-rdzssafb89
SHA256 4eb1921f7ff89646d87bc516800b0e6e314ba32eea061e3003eec99bd2d7b393
MD5 914118adce33096f09f61dc7c4786319
SHA1 21bfd68e49d54c7a9ee14646533e11e45cb3c0e8
SHA512 4ed841ad8bd18aa4415456fbd47b3e08f25836127e0d99955012b4bb1cc9153f5e5a26ed898d9288c24eea67c2ee4b05d79e002aa29b9543e254a943717d33e0
SSDEEP 49152:UWXRQUHap7dM5mJRbsrJl6D3g929mrgbkBW2Zxk754qGp6bw3Pq:USRQSb0IrJMg929NbkO754qTbw/q
TLSH
T195D52312B610D686C109A17096F7CBB96C177D0E6C456A0FB3E43F6FFA7A32B2821157
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_Trojan-Downloader.Win32.Upatre.gxkz.914118adce33096f09f61dc7c4786319

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.gxkz.914118adce33096f09f61dc7c4786319

.exe 2.8MB

jaffacakes118_Trojan-Downloader.Win32.Upatre.gxkz.914118adce33096f09f61dc7c4786319

IMPHASH 2eabe9054cad5152567f0699947a2c5b
SHA256 4eb1921f7ff89646d87bc516800b0e6e314ba32eea061e3003eec99bd2d7b393
MD5 914118adce33096f09f61dc7c4786319
SHA1 21bfd68e49d54c7a9ee14646533e11e45cb3c0e8
SHA512 4ed841ad8bd18aa4415456fbd47b3e08f25836127e0d99955012b4bb1cc9153f5e5a26ed898d9288c24eea67c2ee4b05d79e002aa29b9543e254a943717d33e0
SSDEEP 49152:UWXRQUHap7dM5mJRbsrJl6D3g929mrgbkBW2Zxk754qGp6bw3Pq:USRQSb0IrJMg929NbkO754qTbw/q
TLSH
T195D52312B610D686C109A17096F7CBB96C177D0E6C456A0FB3E43F6FFA7A32B2821157
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

eb:4c:d6:93:96:5c:fd:c8:2c:ad:af:6c:66:15:52:56:e2:26:74:bf

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Telegram Messenger LLP,O=Telegram Messenger LLP,L=London,C=GB

Chains

Mar 25, 2018

CN=Telegram Messenger LLP,O=Telegram Messenger LLP,L=London,C=GB

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Telegram Messenger LLP,O=Telegram Messenger LLP,L=London,C=GB

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

1b:e7:15

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 1, 2014 - May 30, 2031

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Telegram Messenger LLP,O=Telegram Messenger LLP,L=London,C=GB

Serial Number

84:cf:3f:73:ed:b1:0d:86

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 9, 2016 - Sep 10, 2019

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Serial Number

ef:95:c2:f4:80:e3:1b:93

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 14, 2017 - Nov 14, 2022

Minor OS version

Major OS version

Entry point

7741440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

165KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

269KB

Virtual Size

810KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

cdvgmjyg

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

kqpahajq

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

jaffacakes118_Trojan-Downloader.Win32.Upatre.gxkz.914118adce33096f09f61dc7c4786319

PE Signature issue

kernel32

generic