36c45043cd48b826a865c59570633eb2f96e02e8edf5405347f15b8ab118221b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.AdWare.Win32.ICLoader.dkas.b02a9dd41b3e716aad69e8af50e5cfe9
Size 3.3MB
Sample261015-2mpz2stsfs
SHA256 36c45043cd48b826a865c59570633eb2f96e02e8edf5405347f15b8ab118221b
MD5 b02a9dd41b3e716aad69e8af50e5cfe9
SHA1 4cb10e55769f5048269b0954c0026bcf1d02ff67
SHA512 9dd3953677eb5e9a911111b8275d7ff216b09cc3c695d351711a8726da161d3f8e370c879e0b22b7c78ba42e86afc847a26d18ea8f3eb7f07d88e249b13e6bdc
SSDEEP 98304:1VfxQsmlheHL2vz1xp5fwRaK5f0GjAOamxh6QLpfeiZ:Xfrmlherqz1xT4R3KGhTpfpZ
TLSH
T1C6F53354DD80AD04EE7252B1E237F77FF2AF9E24D400A90EA71865CEBE507C19F24668
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  jaffacakes118_not-a-virus.AdWare.Win32.ICLoader.dkas.b02a9dd41b3e716aad69e8af50e5cfe9
- Size 3.3MB
- SHA256 36c45043cd48b826a865c59570633eb2f96e02e8edf5405347f15b8ab118221b
- MD5 b02a9dd41b3e716aad69e8af50e5cfe9
- SHA1 4cb10e55769f5048269b0954c0026bcf1d02ff67
- SHA512 9dd3953677eb5e9a911111b8275d7ff216b09cc3c695d351711a8726da161d3f8e370c879e0b22b7c78ba42e86afc847a26d18ea8f3eb7f07d88e249b13e6bdc
- SSDEEP 98304:1VfxQsmlheHL2vz1xp5fwRaK5f0GjAOamxh6QLpfeiZ:Xfrmlherqz1xT4R3KGhTpfpZ
- TLSH
  T1C6F53354DD80AD04EE7252B1E237F77FF2AF9E24D400A90EA71865CEBE507C19F24668
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $1/Mp3tagStuff.exe
- Size 187KB
- SHA256 6eeba724169efafac2a26476f4a68b0db137fbb3327d9ca58cdd6818edac5a3f
- MD5 b9dcf691fa36d76605dfaa9afd513681
- SHA1 d479381b5cc554f1a3429a8e5564ca8e052bf501
- SHA512 0b3ea4c6f0dab00f6c0af13280c229ac9ce5f84716ce300d444b7006a32cd9b32c4f0e12602b259d1451d19dd2a127acb59ff0c1d3b9962e29899c474ede3a21
- SSDEEP 3072:OIw6zfdj1MKpcTiOiWX4mmAUKfFBCtsAg0FujhN3z/VrfvPjSgZ:3vp6ixa47PsAOxfVZ
- TLSH
  T131147C1075D2C4B2D172593108E5E6A56A3DFC350F658A7F67D80BAE0F741C0AA3AEB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $3/$APPDATA/Mp3tagApp/uninstaller.exe
- Size 39KB
- SHA256 b268468a7b581e824cf6c17443dc7a625b5646b597e5ce0c10976664b6c9b116
- MD5 c15bb96bf37c44d8a84ccebdb5de7085
- SHA1 369f656f528a8b5cd73d9fe9782c4619ddd107ad
- SHA512 7ad04405c543822b587f2345897056071c9958b2908880e53388aaf706f20b36c4eae50ee8ec76d8dde459a0031fcd5f987eb76d95ead17840e5829aaa96b911
- SSDEEP 768:GJKOdm9o29rJYypQJ2JQJXJuKU+duC1ZHQ0D3LHSGiVNulJRn1BJ:yTdm9B9lYypfMXvugHQ0DbLiNuL7
- TLSH
  T1E3037C01B3A0C56BDAB24A712D766B7BCFFA952125516F0303507E9D3D222C2EE1E392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $3/Mp3tagApp.exe
- Size 448KB
- SHA256 fba24a84197adb0da624bc55f8c7f792578ba4b011f10dbdaf060e47f27d1644
- MD5 4ab4dc5f56e3911dc5fd232f6a8355ed
- SHA1 561603d8077e09becea75b7b01e73a5f32bc29b1
- SHA512 c79d0a216fa8372178e08d24c8fd8fd0297326e2f5e1f52d490fc29eae4cfe3ba2579ec13e9996c64bd57507fdcdd5e23b4e95fd2a3b8c8a2ec9ac488a6f17bb
- SSDEEP 12288:/CGDwGIrJGLBKkJmN5u3s95EbJ6/M+TL:sGIrJm/JmG3s95Eb400
- TLSH
  T1A9A48D107AA2C037E4B389334EFCB69DA1ADBA111F1591E773D4061E9E719E1BF31226
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $R1/Mp3tag.exe
- Size 6.9MB
- SHA256 b629e1db17488424af8bd6fdf2e364740db94fe01a8f620645679923bebf2ff5
- MD5 ad010eabb44c4390230f4b92435097ab
- SHA1 befe957e74018d2edb622f2a9c31469bf3880cd3
- SHA512 d6f3ec8448faf615de9239929bf2ddd3008cf92094c4ca796796e2c74104980bd56c631aa7d244099585ff8f2f4d5be387878fcfc2e9ed0ace8f8e5848472cbb
- SSDEEP 98304:WPYSQ3h0DOVAXzgcAyGsa5ZLNHnJ2PW/GVqAQqJKPr/TbmP3U6K:WecbzSyPa51NHnkPgnD/Tbj6K
- TLSH
  T1DC769E217A41C479C6A202719C2CE6AD56AEBE704F7045DBA38C3F1E3E705D26E3196F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  $R1/tak_deco_lib.dll
- Size 112KB
- SHA256 6b48b47a291aab210d4003caba93b31dfa39a1ca759615d3d042327d65d539de
- MD5 c0befabef9c73e9e523a9daba349c7e8
- SHA1 f4900921865b058067b6085a183bf68a0aae9cb1
- SHA512 0cd9d5ee934b317624fe665b479b579536c16a653ac3c06bc8b541f3e4705af8f5b737d7e01356c64330b9d0482f4d6a30e8092a33f048f1e8d0a244c8f849a2
- SSDEEP 1536:5vq1zsdXYjZm9x+tRRWpPEKaY1K/+r61mm063SMf/hzKwOAjjIAPFhUJVrNT:QzMMgmRW1ZdkSMBKNAd909NT
- TLSH
  T184B38D23FA904C72D0613B388D16E374A47FFF511F2D029BA6D9995C8D391813AAD2D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16