ddd8e6084c48d2727bdbc6237b50dad5307a1092f456b461bd7d98a8d4870688

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.oijx.51c31f9911c5a75a7087f939eeb78ed5
Size 546KB
Sample261006-tkl7daz19k
SHA256 ddd8e6084c48d2727bdbc6237b50dad5307a1092f456b461bd7d98a8d4870688
MD5 51c31f9911c5a75a7087f939eeb78ed5
SHA1 bb5c133a412ed38a4bb73e28ac57768e3bc36ae6
SHA512 140230d5ffba1b961735800d782ee3afc0d1aed7441b91cfc5e98de42b1220af51fa7f7a2c20235295703b2e4a196b83e40f53ed60b5d5e33fd34b3a1bbc477c
SSDEEP 12288:78DMwg1uNREw2SPQbBm4FnkXaMxkTp5wvLnppLiqsy82:NuNOxYOnkXVkTpyjXwV2
TLSH
T1E1C4AE52A10A4043F62B36F03B5F496512A02EB46C8C266E21B17F1529F235BED7FF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jaffacakes118_Trojan-Dropper.Win32.Agent.oijx.51c31f9911c5a75a7087f939eeb78ed5
- Size 546KB
- SHA256 ddd8e6084c48d2727bdbc6237b50dad5307a1092f456b461bd7d98a8d4870688
- MD5 51c31f9911c5a75a7087f939eeb78ed5
- SHA1 bb5c133a412ed38a4bb73e28ac57768e3bc36ae6
- SHA512 140230d5ffba1b961735800d782ee3afc0d1aed7441b91cfc5e98de42b1220af51fa7f7a2c20235295703b2e4a196b83e40f53ed60b5d5e33fd34b3a1bbc477c
- SSDEEP 12288:78DMwg1uNREw2SPQbBm4FnkXaMxkTp5wvLnppLiqsy82:NuNOxYOnkXVkTpyjXwV2
- TLSH
  T1E1C4AE52A10A4043F62B36F03B5F496512A02EB46C8C266E21B17F1529F235BED7FF5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery installer persistence privilege_escalation stealer
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
- MD5 431e5b960aa15af5d153bae6ba6b7e87
- SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
- SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
- SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
- TLSH
  T1B0524BA597CCCBBFC7511537B98A273257E993303924615FD9631FC92922853A93B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH
  T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Uninstall.exe
- Size 147KB
- SHA256 1d195e0b6b402ad6aea1167e1e183d8b8f89d617efad14b3675cc5dec98d1009
- MD5 3aaa886ce0e9e0510c34ad9354ec1d32
- SHA1 2bda2a582053b9e3541f0b041fa44a7c072efb03
- SHA512 3436ba3e13ba3a630ead16ecf910a7c0dc4c8e3b48e68d3a043032a70ebc7f445ca021ade87e7482b39a31e0b8dcfb51b3675181b5dbe3ddbc7afa87fa38beca
- SSDEEP 3072:+gXdZt9P6D3XJoaKkjrDMf08Ug0q2Qr//gc0rkYKnvvwIGBOOG:+e346anDMf08Ug1uNAL
- TLSH
  T1AAE32E52A00B4043F53B3AF02B4F496412A02EB56C8C266E61B57F1529F235BDD7EFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery installer
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
- MD5 431e5b960aa15af5d153bae6ba6b7e87
- SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
- SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
- SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
- TLSH
  T1B0524BA597CCCBBFC7511537B98A273257E993303924615FD9631FC92922853A93B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  WombatBHO.dll
- Size 181KB
- SHA256 436bc384a77569d15d8b4e0a83ad08c8d403ad3293d228d8bae2e86a32c7ce8e
- MD5 3486b4c9fe57ce355133ad15035f3881
- SHA1 5e2cc050b3b488d77e2963f5d5b6a4b1d983780b
- SHA512 afc76ec21aa8660ab3a5c8288c4adf17cf48fb5bfbf777c56aff8bbd838efb062538d5a1a51a2193be582fe7d3140662dda3a431c459e512429186eb546314ea
- SSDEEP 3072:TxTdzSxOuydBeOimAkiML6LfCnlt6EvrCGxQArBQ3qOs:tTdzSkeOzcMLIfWlFvrCGxQYQaR
- TLSH
  T13E045C113A43C63AD39B123289BA9B16256DBB210B6781C73B9C6E7D5F706C27E35307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral17 behavioral18
- Target
  WombatBHOx64.dll
- Size 215KB
- SHA256 480c913d4504b718c5437834ef4529e936065ae7b2799ac8fa76027e17967482
- MD5 e4eef89add1ab6b1a9faf397ca4246d0
- SHA1 6df6e9c8eb4279cf60572e78236238695ef47630
- SHA512 d3849346b3f9275bc47e02810720e03cf62d181bab470b4aa568a8f74d952b419317f20b3cf1baf4e640375e921c47c9b4e0cf2116689997c864c2dc9c554683
- SSDEEP 3072:z5vLjozpWCCM8N+AhXzjATBjOZ2iTnZtN7tI0/vf2tQDbwYU4fmLIn:zmpIM1IgtjOZXTnD5tI0Xu1YJmLI
- TLSH
  T173244A1673A840B5E4A79139C9978B85F6B378420B3183CF226453BEAF3BBD56D39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware persistence privilege_escalation stealer
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral19 behavioral20
- Target
  adlesse_disabler.js
- Size 2KB
- SHA256 7754609ddc35dfbc6f8458f8fb830d3a9d3c031ad6fe64bf27433196c1e30c2b
- MD5 14284aabc3816a3daf44c1f1776202b9
- SHA1 2fb1fe4d06a16e9c49d567d927c4447a37e0ffb9
- SHA512 7c4a5130484aac9585e3bafa48fce7953c08205aa7690e8204ce570036a6037ec6125e61b5281dd28f1fa877fe06e6e645c4b1d43059bbfae122fb1a5d26d078
- TLSH
  T12F5130F17692B5B08ADF11BDA32B9407B67C48D7788EA1709002CCE83C3CC958266F99
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  cached_http_request.js
- Size 797B
- SHA256 7740c36edc047f02de7b1102f97da27d3498e703007d2319ef09f5d466519fa6
- MD5 fbe5fc46464747eae76387483cc233bf
- SHA1 858f997654508b671400db3e66459ae4bdb3ef81
- SHA512 5651bae7568dfff9ca4db8d3b54226e0bccc962e07641f7ebd1c4542428b5adffd02938f76be831cb17c91d7fdee266beb96065001d27e99da88dae6f0eb6671
- TLSH
  T13F01EF452791306CE806145DE819BA00213DD1C8350FC477E029E9A7CC6420A9608B8E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  fastesttube.js
- Size 15KB
- SHA256 dfa68a1a12f86a15cb4094eed5e292fddc5843b2a2793aeeca0f8d1416bd6e5e
- MD5 4c1b85511958cf187a8802e2d4935935
- SHA1 9fa37228a9d3b01220d129042393f30930a712bc
- SHA512 6862281d86c304ea66c859faaa4e440556c2e3cd5fc57ef328cd71b0017be7674d0f9a2d5d7f4f0469168e07a7a1c78fb68f933f21ee2f3dd9846b0450ef882a
- SSDEEP 384:vgsahs7MlIysFW21TQURQ3oobU0I3JC54A41p1BTIif1Dh:vgzTKg21TQUq3oobU84A4xBTIkh
- TLSH
  T1A46239F7B18319384BDA36A8200B1844B63A49DB5DCA4570C84ADDB568BCFD910BFFD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  includes/frame2frame_messaging.js
- Size 2KB
- SHA256 ad64efad1dd64d00a89addd194009125a320e4dda74245d5456501d468581fe4
- MD5 0f207199f72a59bd04d3f27dc86f0910
- SHA1 a7208c646838862f45e21fbb7ab1056c9946931d
- SHA512 dd3bc5eb09afc40d84c47368b2a7e11ab587e7616a718b7e274766d532b5dc05dc2b2ca6632b71962e74f36839284bf971f9967aa22d095b18689274e0096223
- TLSH
  T1825131DA7390AE3441F6E22FB12FB308E53E9584B80C5044B259CDCEBFA5E8B1162F54
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  includes/frames_communicator_content.js
- Size 4KB
- SHA256 54fcec46d06b08e3824c804799a6921ec29701bbc3ade9b2b790649631996d7a
- MD5 1fac31173c08a7219e022b910429ff6f
- SHA1 5537487aa9f446dde5cdb66ac235823c8bfe964e
- SHA512 d58a29e5a9b048160252ade18b7216a1e3182aa25359941c89469b343ffc570a017f497a8cafab36509438c55582074bf0519139485055a82c8c4a8e473f3221
- SSDEEP 96:vPn9GRn+9hwcaLwEFALMBkAy/PZu3Z1hlkYBAskV:vPnuGm8uAukAy/QZ7lSsg
- TLSH
  T151A173CD12B46D7F91A2B1A9603B220B703E58467E06A8C0767D8DCC5FF8B562117FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  includes/greasemonkey_client.js
- Size 11KB
- SHA256 49c874ebee1841cb1c172f542936cfc4da5525519d3a7c2e15029e59285b3452
- MD5 9b73b063ce88a56bcd42ea8838b6e229
- SHA1 4921a53bfcf2b0f8d746e30a08302d0bddac7a77
- SHA512 e1f5e0f092fcc44f080752743f6b9d513ce54211ca2ba244a5a5ccf9e895cd06199a36c0b6c653f8a8d00551277d515f10fb9dbeec73b8a70a53230f9c1f9e4f
- SSDEEP 192:s5O+X0vYUyggg+GBJZRCFxoS02ewtPy1BOnTjp8gmaC:s5O6pN02gBOHp8gg
- TLSH
  T1EF3285DA7AA5712142023378953F1007702E54E4BC2B8468BA3C9DEC9FF9D4C5E96F1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Installs/modifies Browser Helper Object

Drops file in System32 directory

Deletes itself

Executes dropped EXE

Loads dropped DLL

Installs/modifies Browser Helper Object

Event Triggered Execution: Component Object Model Hijacking

Installs/modifies Browser Helper Object

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32