7b662da6467ab0b36b50c61fe4d9e5f2659c454bc0a4410ef635334c2043d994

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.VB.iegs.f128b6715f1abc3436460353a4ebefff
Size 2.7MB
Sample261006-rssb9act5r
SHA256 7b662da6467ab0b36b50c61fe4d9e5f2659c454bc0a4410ef635334c2043d994
MD5 f128b6715f1abc3436460353a4ebefff
SHA1 93285e9dfffd9e8d1e3e880ad699196550d66753
SHA512 e72f1c64a1d1adb201a7fd3c931f0cfe4665038576d9e3f3a85b63e8983c4e1251fee3e13cb10381247889d19e2229716de64441f0e033a12ac77db6760143b6
SSDEEP 49152:UuTEHYxG2j1aRToRwmZE11S8Hod8GAWhv/4m8cu5O5j:zT2YxG2paRo1EC8Hod8GA0XScyqj
TLSH
T1BBD5339338D2DC7BE529D1F038B04C69B073D6638E50C89B3B909F466A7F84C675E269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  jaffacakes118_Trojan-Downloader.Win32.VB.iegs.f128b6715f1abc3436460353a4ebefff
- Size 2.7MB
- SHA256 7b662da6467ab0b36b50c61fe4d9e5f2659c454bc0a4410ef635334c2043d994
- MD5 f128b6715f1abc3436460353a4ebefff
- SHA1 93285e9dfffd9e8d1e3e880ad699196550d66753
- SHA512 e72f1c64a1d1adb201a7fd3c931f0cfe4665038576d9e3f3a85b63e8983c4e1251fee3e13cb10381247889d19e2229716de64441f0e033a12ac77db6760143b6
- SSDEEP 49152:UuTEHYxG2j1aRToRwmZE11S8Hod8GAWhv/4m8cu5O5j:zT2YxG2paRo1EC8Hod8GA0XScyqj
- TLSH
  T1BBD5339338D2DC7BE529D1F038B04C69B073D6638E50C89B3B909F466A7F84C675E269
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
- MD5 3e277798b9d8f48806fbb5ebfd4990db
- SHA1 d1ab343c5792bc99599ec7acba506e8ba7e05969
- SHA512 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92
- SSDEEP 192:d4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjsK72dwF7dBOne:Wn3T5KdHCMRD/R1cOnrjs+BO
- TLSH
  T188622B55738488F3DBD2003E785237079B995565B4929ED2CA275FC6683B08D7EB2303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $SYSDIR/COMDLG32.OCX
- Size 137KB
- SHA256 64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195
- MD5 b73809a916e6d7c1ae56f182a2e8f7e2
- SHA1 34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5
- SHA512 26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333
- SSDEEP 3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH
- TLSH
  T1DBD31A9273F66222E4B73B31297A27A06EBABC115D39D54F6710724D0832AD0DE74F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $SYSDIR/VB6KO.DLL
- Size 99KB
- SHA256 52b64e2bfc9ee0b807f2095726ace9e911bcd907054ac15686a4e7d2fd4dc751
- MD5 84742b5754690ed667372be561cf518d
- SHA1 ef97aa43f804f447498568fc33704800b91a7381
- SHA512 72ac19a3665a01519dac2ad43eb6178a66ad7f4e167f2a882cbca242978f8debe3e15d0e210c3b0391590699999f33a1fd5de4ca6559ff894b4e6cb4ac1415a0
- SSDEEP 768:J2rURM7RMwTQvsF51u5tyxwgyBEkLki6Ynb:J2rwWRjM0FCagQi6Yb
- TLSH
  T19AA3A637E2F9C112F4F2A7746BB647E3822678D16723D90EC720105D7970BA8E9213AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  NRank.exe
- Size 1.4MB
- SHA256 6f3071bd164a0b5458660dcbdcaa541f4e957d7682ab0df3ee6df76eb42e3bf0
- MD5 c256c176790e466269747f113d3eb157
- SHA1 c9ab2d24ca01e42a2454d175075d288a74e97e82
- SHA512 f04b2e225472bb5ff290be740540a3b4475df2bf77320cd210dc197ec3bf51a73119b54beab19b6354b2f9a91ecac79711e30f587d886724bfae7b962764fa31
- SSDEEP 24576:Q25v0yKoVycE6w8GFyDdJTffKosYTm7kcEU+FPQeXb7KQfmn3:DmoVyowWPKUAQjnfY
- TLSH
  T18B65333176EACBACF2080D35BEB8E174C04536636AEED6DB4846953DE77C601316683E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral10 behavioral9
- Target
  Update.exe
- Size 1.3MB
- SHA256 f3490f455d22ec7714580736caa4f18be48a303021e0bfc236ffb58a7ccf48e0
- MD5 cdc31d273398ad252ea260ad410dad42
- SHA1 e20bc647cc136e1fdf6a3a3d8a5b9e59f7704a38
- SHA512 732285e86f5d851c2228343e94957e923e2dc57e21c8bc9b4ab2c44e50a832de218e0b54a62548be9c660cbd7d2f17c94295fca05f4917d542bb16c4c97ee780
- SSDEEP 24576:bcvwkGs1TtOWollWtDl5ax4Xqe3G48myCwE9y+3netdk5cZlRP:bchTtxoKtDaOXqUnwh2Adk5cZlR
- TLSH
  T19A55332615C5D53AD48726B3CCE746FA6B542C338CA4874B6D50BF00F2B2486E7EAC5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral11 behavioral12
- Target
  uninst.exe
- Size 50KB
- SHA256 c93faef0948c62711735bbeacb3c1eb49a20e8307ce4a5dc82c967742f041767
- MD5 4e057ef32d657c6590e0ae555e4710d7
- SHA1 a25dcdedc2923d90460ef9dc4c2d547ada42f0a8
- SHA512 bf386cb2771b6ca8b8d47f512baecbbed7887f8d333ee64c5689dc085adf673afc493ba2cd47419f0a804255627d3d0f70c3d4375bcc418c473ea7aab3af78ba
- SSDEEP 1536:5aLuXE8XPIYyr7jvN0DoJ+cpgdLeAyNJ1W:0LuXzXwYyr6DoocpceASW
- TLSH
  T15C339E076B60C8F7CA75027009BBAB7BAFF6C61011549F1357806F1B7D232528A1E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery installer
- Deletes itself
  defense_evasion
- Executes dropped EXE
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Identifies Wine through registry keys

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Identifies Wine through registry keys

Suspicious use of NtSetInformationThreadHideFromDebugger

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14