fd2649182b9f6e257500a86dc69fdd94a8fd80acb752d2f7779d199f7a3ababd

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Nisloder.ui.cb4367db67962f36b38ed5f2cc2c3235
Size 514KB
Sample261018-spvtmsfx51
SHA256 fd2649182b9f6e257500a86dc69fdd94a8fd80acb752d2f7779d199f7a3ababd
MD5 cb4367db67962f36b38ed5f2cc2c3235
SHA1 9f5574be9cbf6983ffeb1fec2b8ad72b87967674
SHA512 80ce8b6dde4a7676b014391698c9ca8f27dda1ce1b9cab483b2f1926996836fb9b995b967ccecadc3bcbd4086d90a683868049ce60907152cf6565fac9cc08cc
SSDEEP 12288:tsp8SE5ArAhq13jWaqsB5eol5auT04wy3ePPPz+JwXwh:Oi5q1pqsauY4srWV
TLSH
T117B42340B3D120F7E9961D320DF6E297D27A17F9F729505F2B044EFB38E62A641192CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jaffacakes118_Trojan.Win32.Nisloder.ui.cb4367db67962f36b38ed5f2cc2c3235
- Size 514KB
- SHA256 fd2649182b9f6e257500a86dc69fdd94a8fd80acb752d2f7779d199f7a3ababd
- MD5 cb4367db67962f36b38ed5f2cc2c3235
- SHA1 9f5574be9cbf6983ffeb1fec2b8ad72b87967674
- SHA512 80ce8b6dde4a7676b014391698c9ca8f27dda1ce1b9cab483b2f1926996836fb9b995b967ccecadc3bcbd4086d90a683868049ce60907152cf6565fac9cc08cc
- SSDEEP 12288:tsp8SE5ArAhq13jWaqsB5eol5auT04wy3ePPPz+JwXwh:Oi5q1pqsauY4srWV
- TLSH
  T117B42340B3D120F7E9961D320DF6E297D27A17F9F729505F2B044EFB38E62A641192CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery installer persistence upx
- Modifies WinLogon for persistence
  persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
- TLSH
  T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/counterpunch.dll
- Size 68KB
- SHA256 9fa3cfd7236097bb87445e9401916037797a84fe56768cd3fa63dfb470950cf7
- MD5 945b5b91aeda04c62a3dffad18eb1dc7
- SHA1 aef842a008d05332ca5f8206077204645983f1cc
- SHA512 9fa1ed5f550515e737eca5943d898d814e0c180299f0b64cdec170ccab9ca9c74cfcaca65faae7dcdfbcc9d0c4c172ff0bd6c65b84a70e19823ce7ff4192cb84
- SSDEEP 768:xJzu7/F7xIyMgNZpDReu51Kl7+Dql0J9Z8aY4it8oP8+lu:H3PgNrFeYqWV8awt8oPFu
- TLSH
  T1D9634C113A9184FBD58E413804A7CB72163ABC4256F694533FD76AEF4E326A0F53B30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  WindNinja-2.0.1/Uninstall.exe
- Size 49KB
- SHA256 59da837155daeb16cc292f403995134103ef28109a3d76a944e8485266c599c1
- MD5 5baa74e26a59fb847a09b0b6b54ddf7d
- SHA1 904e0c52e472ffd98e223046eef5b378b72447fd
- SHA512 ca1cbb0427299b8de745782f53c62d1bf3564b7dad03441fa450b6442b386e67fd6d179433e5f8ec5f94dc2f75135b60dc1383e1b616017adb6b97ddbf5956af
- SSDEEP 1536:WwJOoN1oYaoZ5iV685XJPChgdLeAyNJzZS:WwJ52Y7ZoH5XJahceAUZS
- TLSH
  T13D33AF1337C584ABDBA605710EF7E7BAE7B5F7B021158A5B2B009F7F6D602838E05186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery installer
- Deletes itself
  defense_evasion
- Executes dropped EXE
behavioral7 behavioral8