b027fdc658589d3f193d2a0896fd9c9c064a1f62ddeef9a90479b93c2cd8ecb9

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.4c73b756dbb708b8f2d8ff7c144d77d8
Size 437KB
Sample261014-dcppjaex3w
SHA256 b027fdc658589d3f193d2a0896fd9c9c064a1f62ddeef9a90479b93c2cd8ecb9
MD5 4c73b756dbb708b8f2d8ff7c144d77d8
SHA1 482158aff860750b0250f2b9835cea797d417985
SHA512 acf7d39dd13cd6570b1e7a1ec46e96707b7607fff82caef17ed30ca149db4c8a8eea953a6054fc4534fd9ba6caf7f95aa2e1d10e24f90415fa9fc5bf7d0ba7d8
SSDEEP 12288:m1v2GaczrO+SxFvxKtqabcjhnNZH8k0uWIv:mgGDvOpjAQabcFH8k05Iv
TLSH
T1B594234950B51DFFD8CE0634447BBA3CD6F6DBA821DD6B834B286F797AF40468D24A01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.4c73b756dbb708b8f2d8ff7c144d77d8
- Size 437KB
- SHA256 b027fdc658589d3f193d2a0896fd9c9c064a1f62ddeef9a90479b93c2cd8ecb9
- MD5 4c73b756dbb708b8f2d8ff7c144d77d8
- SHA1 482158aff860750b0250f2b9835cea797d417985
- SHA512 acf7d39dd13cd6570b1e7a1ec46e96707b7607fff82caef17ed30ca149db4c8a8eea953a6054fc4534fd9ba6caf7f95aa2e1d10e24f90415fa9fc5bf7d0ba7d8
- SSDEEP 12288:m1v2GaczrO+SxFvxKtqabcjhnNZH8k0uWIv:mgGDvOpjAQabcFH8k05Iv
- TLSH
  T1B594234950B51DFFD8CE0634447BBA3CD6F6DBA821DD6B834B286F797AF40468D24A01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence spyware stealer ransomware
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $SYSDIR/$_1_.exe
- Size 40KB
- SHA256 22baf1c02ef343b1c018acb3dfa805fa08ddc87f8a7c78596b497e5ec08c134a
- MD5 ab142fb749e826146382097ff4380cab
- SHA1 940404539991c6e90dd6fe55697af31517a12999
- SHA512 414ecd9b2579ddceddf6304d024f66ca9670317a161b355ce5199dcefffd043382d915cc2bf0e4156d39d661875d0a9c25e26438c8ffbd4f623811110d6996d0
- SSDEEP 768:kHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJ5JRnm55pfRxB0a:kpgpHzb9dZVX9fHMvG0D3XJM55lf2a
- TLSH
  T18B03BF0765C089BBD5D2067106B7B77DEBFAC3DD01911B574BA82FBB3E111838909296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $_5_
- Size 731KB
- SHA256 0c7f38a9380b65dd2f6cd641be934906736064369657d419d6edc96d7c79295e
- MD5 2f0ccc90307825591e493db45c8be8d3
- SHA1 e895134e57545a8b959d1102d716922112d9ed2a
- SHA512 0528a0c00a17b6e51885aad8c739b10df0275a5c4f0f54d2f8b1522381a05a4e47d9795cbdf51d6146627b5e8d5362b80306bf623b7edcf85db58ca0cb4be777
- SSDEEP 12288:uPjVuvC7NEeEMOysYIJeRE3dn2m52+uGk2DgZjTV571c3Z8Fj0vH:u8ahtbOyXRENnZ2+TkIgRuZ8FCH
- TLSH
  T1EFF48D1931D0D4F5C76005791D08E33A973E9C724BFA006ABBE953A82BE688057DEDB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware stealer
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral10 behavioral9