fb16ab76f49affe64b473f88547b1dd10c15930574ce976d3468e44b55f464b6

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.AdWare.Win32.ICLoader.dkxm.1004ecd1252c7e83e806fd5b9d7d9e63
Size 3.3MB
Sample261018-tmcqqabf97
SHA256 fb16ab76f49affe64b473f88547b1dd10c15930574ce976d3468e44b55f464b6
MD5 1004ecd1252c7e83e806fd5b9d7d9e63
SHA1 9e0ff2bd63deeb79c05b8c75256acfd2dcda6dd5
SHA512 4b7aad69523b96f85281ab587ac167ef843a9b1558834ab0993fce976ab9dbab19892f1bfd1055affd72c13225ccfa7cb27171c0039e694e88c675b56893985f
SSDEEP 98304:gVfxQsmlheHL2vz1xp5fwRaK5f0GjAOamxh6QLpfU:ofrmlherqz1xT4R3KGhTpfU
TLSH
T16EF53354D9806C04EE7252B1D177F76FF38F9F24D400F80AA368B5CEBE947C19A24A69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  jaffacakes118_not-a-virus.AdWare.Win32.ICLoader.dkxm.1004ecd1252c7e83e806fd5b9d7d9e63
- Size 3.3MB
- SHA256 fb16ab76f49affe64b473f88547b1dd10c15930574ce976d3468e44b55f464b6
- MD5 1004ecd1252c7e83e806fd5b9d7d9e63
- SHA1 9e0ff2bd63deeb79c05b8c75256acfd2dcda6dd5
- SHA512 4b7aad69523b96f85281ab587ac167ef843a9b1558834ab0993fce976ab9dbab19892f1bfd1055affd72c13225ccfa7cb27171c0039e694e88c675b56893985f
- SSDEEP 98304:gVfxQsmlheHL2vz1xp5fwRaK5f0GjAOamxh6QLpfU:ofrmlherqz1xT4R3KGhTpfU
- TLSH
  T16EF53354D9806C04EE7252B1D177F76FF38F9F24D400F80AA368B5CEBE947C19A24A69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $1/Mp3tagStuff.exe
- Size 187KB
- SHA256 6eeba724169efafac2a26476f4a68b0db137fbb3327d9ca58cdd6818edac5a3f
- MD5 b9dcf691fa36d76605dfaa9afd513681
- SHA1 d479381b5cc554f1a3429a8e5564ca8e052bf501
- SHA512 0b3ea4c6f0dab00f6c0af13280c229ac9ce5f84716ce300d444b7006a32cd9b32c4f0e12602b259d1451d19dd2a127acb59ff0c1d3b9962e29899c474ede3a21
- SSDEEP 3072:OIw6zfdj1MKpcTiOiWX4mmAUKfFBCtsAg0FujhN3z/VrfvPjSgZ:3vp6ixa47PsAOxfVZ
- TLSH
  T131147C1075D2C4B2D172593108E5E6A56A3DFC350F658A7F67D80BAE0F741C0AA3AEB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $3/$APPDATA/Mp3tagApp/uninstaller.exe
- Size 39KB
- SHA256 b6458330bd26085a6e3c38322d70d08f0425d125a0546aa84820b2cbaee2b89b
- MD5 34e498e1434b84fabb66e210cf664ecd
- SHA1 b6d18866e3bcdb2a392430b54c26abf0b6703bc5
- SHA512 b355c09cd6b68be860a20f24987ad009f4502f13997230a57e9cf45936a7cddde3744d54512f30758acb873511ca2c33f50366b8810f68cc2e81e7bc554268e2
- SSDEEP 768:+JKOdm9o29rJYypQJ2JQJXJuKU+duC1ZHQ0D3LHSGiVNupJRnd7BL:qTdm9B9lYypfMXvugHQ0DbLiNuz7N
- TLSH
  T176038D0173A0C56BDAB24B712D766A7BCFFAD52125516F0703507E9D3D222C2EE1E392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $3/Mp3tagApp.exe
- Size 448KB
- SHA256 d323b94408f55c10a286d37bb638cdc33e69983f885c090d3f7bf1a5468bbc53
- MD5 3361e896234304716c5b0cc9f2ba48dd
- SHA1 da6e815177aa46e7a7565fdd17d861e011dbc3ad
- SHA512 16c79fc7fc1779b6fba658741a399c2f476bab100d10eaefbba1ddfdcbf9c45b4ba5fc8b796262db6548f67aa165808905aacce53e2bbbca13788e09acf1cc66
- SSDEEP 6144:D76/2pyjMbK9KCh4ki+Hoonk1xG6G0lQ5m+o+hu/9MOYiFzzAO4uVLYN:D7m2pOgKcCt6oUUR5ro+qMOtzOuJYN
- TLSH
  T1D7A48D107AA2C036E473C8334EFCBAADA1ADBA111F1595E773D4061E9E719E1BF31126
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH
  T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $R1/Mp3tag.exe
- Size 6.9MB
- SHA256 b629e1db17488424af8bd6fdf2e364740db94fe01a8f620645679923bebf2ff5
- MD5 ad010eabb44c4390230f4b92435097ab
- SHA1 befe957e74018d2edb622f2a9c31469bf3880cd3
- SHA512 d6f3ec8448faf615de9239929bf2ddd3008cf92094c4ca796796e2c74104980bd56c631aa7d244099585ff8f2f4d5be387878fcfc2e9ed0ace8f8e5848472cbb
- SSDEEP 98304:WPYSQ3h0DOVAXzgcAyGsa5ZLNHnJ2PW/GVqAQqJKPr/TbmP3U6K:WecbzSyPa51NHnkPgnD/Tbj6K
- TLSH
  T1DC769E217A41C479C6A202719C2CE6AD56AEBE704F7045DBA38C3F1E3E705D26E3196F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral13 behavioral14
- Target
  $R1/tak_deco_lib.dll
- Size 112KB
- SHA256 6b48b47a291aab210d4003caba93b31dfa39a1ca759615d3d042327d65d539de
- MD5 c0befabef9c73e9e523a9daba349c7e8
- SHA1 f4900921865b058067b6085a183bf68a0aae9cb1
- SHA512 0cd9d5ee934b317624fe665b479b579536c16a653ac3c06bc8b541f3e4705af8f5b737d7e01356c64330b9d0482f4d6a30e8092a33f048f1e8d0a244c8f849a2
- SSDEEP 1536:5vq1zsdXYjZm9x+tRRWpPEKaY1K/+r61mm063SMf/hzKwOAjjIAPFhUJVrNT:QzMMgmRW1ZdkSMBKNAd909NT
- TLSH
  T184B38D23FA904C72D0613B388D16E374A47FFF511F2D029BA6D9995C8D391813AAD2D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16