jaffacakes118_Trojan[.]Win32[.]Cozybear[.]g[.]d543904651b180fd5e4dc1584e639b5e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Cozybear.g.d543904651b180fd5e4dc1584e639b5e
Size 797KB
Sample261018-3yxppsvs5m
SHA256 6a177de940ba477574947ed2d06fd7c08c7baf04b83cb7f3a46e4a93f889bf64
MD5 d543904651b180fd5e4dc1584e639b5e
SHA1 84b18a482d65cdec9dbbe571662f734f3366ab0c
SHA512 f697c60bc442a03454d8650d530bb623cb3416423d460227f81be77d560009ccb326d2a92ebc0aebf42680ba8ee6950b514ce749d9ea0e5ddfccff5e5018467f
SSDEEP 24576:oImkHnejU3Aj6B93q9mqCktQBZsOx6gtr/GSOD3C:XXwURfa8q1ssXMGSOD3C
TLSH
T1CE0523B3CB2718883629346856F875BBD4E12D7EBE64489CC92B4CAD9C1F0127D5F07A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3852.exe

File Explorer

jaffacakes118_Trojan.Win32.Cozybear.g.d543904651b180fd5e4dc1584e639b5e

.zip 797KB
3852.exe

.exe 1.1MB

jaffacakes118_Trojan.Win32.Cozybear.g.d543904651b180fd5e4dc1584e639b5e

SHA256 6a177de940ba477574947ed2d06fd7c08c7baf04b83cb7f3a46e4a93f889bf64
MD5 d543904651b180fd5e4dc1584e639b5e
SHA1 84b18a482d65cdec9dbbe571662f734f3366ab0c
SHA512 f697c60bc442a03454d8650d530bb623cb3416423d460227f81be77d560009ccb326d2a92ebc0aebf42680ba8ee6950b514ce749d9ea0e5ddfccff5e5018467f
SSDEEP 24576:oImkHnejU3Aj6B93q9mqCktQBZsOx6gtr/GSOD3C:XXwURfa8q1ssXMGSOD3C
TLSH
T1CE0523B3CB2718883629346856F875BBD4E12D7EBE64489CC92B4CAD9C1F0127D5F07A
MD5 SHA1 SHA512 SSDEEP TLSH

3852.exe

IMPHASH 3eaa732d4dae53340f9646bdd85dac41
SHA256 bc5625c674f08cca18e73eb661eed0182ef16e27983098cf1c61892ca621d60b
MD5 57a1f0658712ee7b3a724b6d07e97259
SHA1 6b0721a9ced806076f84e828d9c65504a77d106c
SHA512 f15b1ce057e455019947c03f05d4e7e5027bf6ad69534462c89267643ba1b063d7cf3434fd0a8320f9286fbe9a451dd324fd52a2d80691271837eb357b95ae00
SSDEEP 24576:h35dPpXWWyarXeNgvI/6Np369kqWkteBlSOlWotrzMSUNj9:hBx70gDrKmqZgSXiMSUNj9
TLSH
T193455802994848AFE303C733146A63D0D150A83F2A2E779A3D65711BFF7DD8BA1C675A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

comctl32

InitCommonControlsEx

shlwapi

SHAutoComplete

kernel32

ReadFile GetFileAttributesW SetFileAttributesW FindNextFileW GetFullPathNameW GetModuleFileNameW FindResourceW GetModuleHandleW FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcessId GetLocaleInfoW GetNumberFormatW ExpandEnvironmentStringsW WaitForSingleObject DosDateTimeToFileTime GetDateFormatW GetTimeFormatW FileTimeToSystemTime FileTimeToLocalFileTime GetExitCodeProcess GetTempPathW MoveFileExW Sleep UnmapViewOfFile MapViewOfFile GetCommandLineW CreateFileMappingW GetTickCount SetEnvironmentVariableW OpenFileMappingW CreateThread EnterCriticalSection LeaveCriticalSection GetProcessAffinityMask ReleaseSemaphore ResetEvent DeleteCriticalSection SetEvent SetThreadPriority InitializeCriticalSection CreateEventW CreateSemaphoreW SystemTimeToFileTime GetSystemTime LocalFileTimeToFileTime WideCharToMultiByte MultiByteToWideChar CompareStringW IsDBCSLeadByte FindFirstFileW GetFileType SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA LoadLibraryA GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount QueryPerformanceCounter SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetModuleFileNameA ExitProcess HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess VirtualAlloc VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetCommandLineA RaiseException GetSystemTimeAsFileTime SetEndOfFile SetFilePointer GetStdHandle WriteFile FlushFileBuffers GetLongPathNameW MoveFileW GetShortPathNameW CreateDirectoryW RemoveDirectoryW GlobalAlloc DeleteFileW FindClose CreateFileW DeviceIoControl SetFileTime GetCurrentProcess CloseHandle CreateHardLinkW SetLastError GetLastError GetCurrentDirectoryW CreateFileA GetCPInfo HeapAlloc HeapReAlloc HeapFree RtlUnwind

user32

EnableWindow ShowWindow GetDlgItem MessageBoxW FindWindowExW GetParent MapWindowPoints CreateWindowExW UpdateWindow LoadCursorW RegisterClassExW DefWindowProcW DestroyWindow CopyRect IsWindow CharUpperW OemToCharBuffA LoadIconW PostMessageW GetSysColor SetForegroundWindow WaitForInputIdle IsWindowVisible DialogBoxParamW DestroyIcon SetFocus GetClassNameW SendDlgItemMessageW EndDialog GetDlgItemTextW SetDlgItemTextW wvsprintfW SendMessageW GetDC ReleaseDC PeekMessageW GetMessageW TranslateMessage DispatchMessageW LoadStringW GetWindowRect GetClientRect SetWindowPos GetWindowTextW SetWindowTextW GetSystemMetrics GetWindow GetWindowLongW SetWindowLongW LoadBitmapW

gdi32

GetDeviceCaps CreateCompatibleDC GetObjectW CreateCompatibleBitmap SelectObject StretchBlt DeleteDC DeleteObject

comdlg32

GetSaveFileNameW CommDlgExtendedError GetOpenFileNameW

advapi32

RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

shell32

SHChangeNotify SHGetFileInfoW SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteExW SHFileOperationW

ole32

CLSIDFromString CoCreateInstance OleInitialize OleUninitialize CreateStreamOnHGlobal

oleaut32

VariantInit