a5c736583da302ece7dce2a808ea5108a942d98200b8edb7f2ce46e57c74ac7f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Agent.nezlpo.96ad0a531428fb7270e2cf30862bdd8f
Size 142KB
Sample261015-227hmsef47
SHA256 a5c736583da302ece7dce2a808ea5108a942d98200b8edb7f2ce46e57c74ac7f
MD5 96ad0a531428fb7270e2cf30862bdd8f
SHA1 3622b865ee7059eb45c5b3c9c99a6e34bca98d49
SHA512 31f4b84b745b05b95e175ce38a1150ffcb1c6cd09dd94e314d122e47215a8d4d08abc796b3fb898c8b36aa3a2d98a119a120fcecc52a524cd6450da513ef3b22
SSDEEP 3072:YbLpZuEskJIMq6Txeus/f4XjlF0InM1MrtGlzqEMTxg324z949feXZYSZ:YbOvMbjlFJn4MrtGlmD+9SGYC
TLSH
T135E3F21E76C1A963EFA341358C77E32AE677AE90051622D797E07F9738B859188021CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jaffacakes118_Trojan.Win32.Agent.nezlpo.96ad0a531428fb7270e2cf30862bdd8f
- Size 142KB
- SHA256 a5c736583da302ece7dce2a808ea5108a942d98200b8edb7f2ce46e57c74ac7f
- MD5 96ad0a531428fb7270e2cf30862bdd8f
- SHA1 3622b865ee7059eb45c5b3c9c99a6e34bca98d49
- SHA512 31f4b84b745b05b95e175ce38a1150ffcb1c6cd09dd94e314d122e47215a8d4d08abc796b3fb898c8b36aa3a2d98a119a120fcecc52a524cd6450da513ef3b22
- SSDEEP 3072:YbLpZuEskJIMq6Txeus/f4XjlF0InM1MrtGlzqEMTxg324z949feXZYSZ:YbOvMbjlFJn4MrtGlmD+9SGYC
- TLSH
  T135E3F21E76C1A963EFA341358C77E32AE677AE90051622D797E07F9738B859188021CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AnimGif.dll
- Size 9KB
- SHA256 54ccdcb42fb3e63b7a55e8c0e7d12182a0338ea38b106b793ca048000a189ab5
- MD5 11e94fedb34f46458f9dc773a91f2770
- SHA1 791cf30880c74df9d6f7c1e637e4fdf5fa88b38a
- SHA512 57dd38bebdd7d8fbc4b3daeecabc5c2617d4f5b2f6ad2396a702f1da362bc72deacfea2dd1550b0e00269188676324e1b7dd6ed372211c8bf664af824ac8d950
- SSDEEP 96:kVh/i//UrWWXMAb+6aNqRjTwUWo5zFyRH0aTyZekTIVCAEHZNKNy0p:uh/Bl8AIQR/bWSMRH00yQBEH
- TLSH
  T1C2121907CA0051F7F12EA0F925DEBB3F9259E1B60286BC57C757ED42AE111615F3A207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/CIEH.dll
- Size 2KB
- SHA256 8ce1c14c24711eef4753f3dc54703fdde3950557a542d3a062d35667b8094692
- MD5 48a08d0adbe110811801bbd220ad5802
- SHA1 b6825225a1ec6a6e3ebaf78a4a5974bad67015cd
- SHA512 1cc88cfd772383b73dcf1ab91f01366874ef5b072d7ab7f4c2c49f31db7fa2a5d1b21c1643015cf52111fc9c3800b0eb87d4a6b64c5b380a4a5318af607e4679
- TLSH
  T1A151D837D3EA08F7E40C43B50B93A86172B6CAB443E6C0111EC60A793941D9CB865F86
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware defense_evasion
behavioral5 behavioral6
- Target
  $PLUGINSDIR/DCP.dll
- Size 2KB
- SHA256 1f30b3485f7d39f5197e1969b3aba61d5d12bd6000b0bc9436685633bfd85299
- MD5 aeeaf32116912d7c75130f1eb94361df
- SHA1 d5050ab2b297ca7b983618732840b523e5069170
- SHA512 38dac79b8277eba224ed4f86cd8ca348410e12cb1fbfd04e1c8dac0aaf3db3fd3dc0f69c36342240ef0ea0761685fabc787acdc498ea6da61c8068197c2aea24
- TLSH
  T1C451DCB7DBD596E3E54C23FA02CB0898B3AF502457B7851E09B6040CA411556CCB3F12
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/EnumINI.dll
- Size 3KB
- SHA256 6889074663561e735e22cc0b687f956f4f98d51529c7f3db610747bebe74e060
- MD5 29dea66f7c3de1b4d84bb26da3616ca1
- SHA1 55e0bac541822d3a3a1f03b04b5dd1bb8149aa2c
- SHA512 d0063e52165c819801a96467cc26caad6d9effe32128c3d24ca575c600cf866edd88bf915a8aca27f517bd383de12c3c5f6afee66329c4faace37235cc1df74f
- TLSH
  T1245165B39FE144F1E04F4772914B2C7329F6DA1027664B0E88374E84894328F9DBE759
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/RealProgress.dll
- Size 6KB
- SHA256 e36cb3caabb806b27475080682837a7d379fbe903358aa189bd0e51511ef27f2
- MD5 34eb3de90b30d2c4d18ee625ac95369e
- SHA1 504dfd3a2e735e94991fa649d4e2defd511a744c
- SHA512 640282d943305f7fd4b512b1b8ffd49b4456b3e5987b11e26a208333d051332a93e261fc764add17b2cb7e7127c00d1905b42233354098afac8b1198e0db9a38
- SSDEEP 96:KSWAk1J5Qrcic6XMqKL6dwNYVZdVJUygr3A34tYVPK:P0j5bRGMqPdwKVXbUn3s4uk
- TLSH
  T148C1747EA7D0A6F3D7114B7A118662572357A03043A8441FAA371DCABEA1347CC5E2B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 49b748d037f7faac0be4f9db080d7bc9a997dec23187c5735826e15be2f32dab
- MD5 ebff9b02b61df14b06df4fa0b121d0ea
- SHA1 a3cb0aacaf26c1812cb8a4aacca6165e7b69aaee
- SHA512 eae47042c70ccdf52e9aadcf57f73c03e06e9591db038c84ffe5c8f29229decedc21b27c55e088f9b6a9198a4552da3f2762e90bc2e543e1534bd7630b129427
- SSDEEP 192:KOShJI/rmOAIPkWpUybQ9WhP4t5Rwc89XbubZar5:L6OAOkWWycGP4XRwc2qFar5
- TLSH
  T186225C5502A042F3DC54923C08973D676F787A249EB48EC3CF931441AF299AABC7D326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/failed.html
- Size 846B
- SHA256 929f4c09a39b7d1005af55abcb20c9358b69832bcf89c479fd17acd4ce8b5acc
- MD5 31190033526afff1aee4816ec0c75520
- SHA1 2ca237ec707e7f47d962dba5e384ccff3587ed4f
- SHA512 df4ed70853d532cc08c6edc5278658e5a6a84daf1d9d6213109e343ee4f56f2f18c8605da43627dc1681eca898af2aea61e0f73cb0fdfa488bbe7a548d73a382
- TLSH
  T1A00152227E220E3C8E2782BBF882536CC5244706836584B4A46A1673F5C843ED4EABCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/inetc.dll
- Size 18KB
- SHA256 29c3bf7b2946d427824fd01db41c10fe6b5011a184ed0ed3a3e5fb4ba50a5ae3
- MD5 312edb3560ebac849ee8cd8396bbc6a5
- SHA1 a6159a98775ad286b27a34fc588bc2a019827f39
- SHA512 877c79f10988d9cebb5fb2591a7a6b5bd925a557687d1c96c9e40b31d365f0556d590953972259d5def231bb452fd0839f28fd2c124145425b5fb5acc48f7488
- SSDEEP 384:TkV3EkbAHbUH1W52u4ZuVlGygT0yl1ViY0Ac9khYLMkIX0+GMhg8ae:TrHQ1I2u408ygTjl1Viw
- TLSH
  T1B2821A421F714EB3C3A64534B4A927170B7A9F7164A2A09367F31E8C2C99207FF79B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsWebN.dll
- Size 25KB
- SHA256 33faeecd2c66a9935636acb1a6fe60d931276953d9220c8ed442beb452c3db39
- MD5 76587d0bb39396ec23bd6e216236656b
- SHA1 e594fa281cd779846b75488447ad32469911b256
- SHA512 1085480a639079acf9b465fbbb3a39935167ff93c59d7257ccebbb88de0d5b3e88e2341b1beedf62a1f35d24ec50f2acf9981eb5f77598f3a35ba9f5cc4eace4
- SSDEEP 768:2lnPepVOUoYCzM6bLVeIyCtUQ4Bb/lc/qVsYV:2RUoYgM6teOUQ6b/lhyYV
- TLSH
  T1F8B2181276A044F1D28A193831A76F46677F956423F160C3DF5B28AEFA533E1B935383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  uninstall.exe
- Size 45KB
- SHA256 de020f6856d9b047b868015a69994954c68ec031179107ad216c39935ff2e84f
- MD5 ebcf8cdfaa9172e7358fdc65656a999d
- SHA1 3278eb5d3158dd1afb670b13f8b753ffb460f185
- SHA512 e27aac2f81ed46e2b34ee52b76ce4d6e4667f510d0e5277bc57cd5eb8f012f2dcb8d3cf256ac21b72039879d9e2f59a9c956af60d0afc8272d9690edf36fbfd0
- SSDEEP 768:tebbuV4LlKWVJd9dxVh1qAOYwXzBx2JqF86eWkJdFcc35Sx2ELVgq8RiUmMF:YbSqZVJdThUxmskJZJMVGqiiH6
- TLSH
  T16B236C1632D0D4B7EAB346705D7BE33AE377AE50021156C727F0BFAB787958289052CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery installer
- Deletes itself
  defense_evasion
- Executes dropped EXE
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Loads dropped DLL

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22