69c0164bd5a3f28737152241ee1a7750c37ab6e80c4c456f6a34237da73c2f71

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Hotkeychick.d.aff493ed1f98ed05c360b462192d2853
Size 4.4MB
Sample261018-wkvvmaca65
SHA256 69c0164bd5a3f28737152241ee1a7750c37ab6e80c4c456f6a34237da73c2f71
MD5 aff493ed1f98ed05c360b462192d2853
SHA1 3f6ed3c3789a54de20ddcdebd640d1e499f6fb6f
SHA512 22fc5b498cc574d93d28c8010f80f135a44b5ae3bbb9b3582d807225059187fceac1fc71a4a091f4b0f4e576fd24b35da8c877919c7c721815c3bdc296acbbd7
SSDEEP 98304:OknlbTXIM747mtTXcWH7jzxNlb5SW5hCIpBUbrUbhkEUQf5Fkcn2IbzR8i2j:7ndcM7Qm1Xzzx/VSS42ePQf56cXzWF
TLSH
T11C26333C5B95747FD81750F946A8A7C8FA208F23A9B8063319515B4EB369F6F8CAC11C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jaffacakes118_Trojan.Win32.Hotkeychick.d.aff493ed1f98ed05c360b462192d2853
- Size 4.4MB
- SHA256 69c0164bd5a3f28737152241ee1a7750c37ab6e80c4c456f6a34237da73c2f71
- MD5 aff493ed1f98ed05c360b462192d2853
- SHA1 3f6ed3c3789a54de20ddcdebd640d1e499f6fb6f
- SHA512 22fc5b498cc574d93d28c8010f80f135a44b5ae3bbb9b3582d807225059187fceac1fc71a4a091f4b0f4e576fd24b35da8c877919c7c721815c3bdc296acbbd7
- SSDEEP 98304:OknlbTXIM747mtTXcWH7jzxNlb5SW5hCIpBUbrUbhkEUQf5Fkcn2IbzR8i2j:7ndcM7Qm1Xzzx/VSS42ePQf56cXzWF
- TLSH
  T11C26333C5B95747FD81750F946A8A7C8FA208F23A9B8063319515B4EB369F6F8CAC11C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation upx
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
- MD5 960a5c48e25cf2bca332e74e11d825c9
- SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
- SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
- SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
- TLSH
  T19A323918036442F3E5D5C83D186A3BAB5B28252196F08F53DFB39881FE386D66D39362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  COPYING/COPYING.pdf
- Size 10KB
- SHA256 00b90f420c502c12aca62e4451d3fc116b1420f2313648f9ae326420f93a85be
- MD5 2bd0a8e232b8a6802097a4d54e9cda16
- SHA1 b1bb2a8bab5b4a9ca32b5398427fdb18c159aa17
- SHA512 d4d30d3bfa4e5163b1e62f66d6a951ee7548ca9bb569191ff4b02f81fd75f12d64bb51d8adf380bc01fce4eb3932da0c19b79b07279a7641e35c2596e51eafb7
- SSDEEP 192:+1YjmAp1LXFqTxNBOcB7iFEorwv13E4EE2ELr7FD3wdx/+YsqzrstlSj:++jmULVIDccBeFE5YcLrxwdZHs+YtlSj
- TLSH
  T1D7225C58E846AC4CED86964B64FD714F883F7C036AC5ACD1769C4E924B51DA0CFB70E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  COPYING/COPYING.rtf
- Size 686B
- SHA256 52ad02a04bc5d05caa906df5ed8557a93686e814b2df748f5e3788145d34f18c
- MD5 82ee8f5fab7d21be5130f2761acb106a
- SHA1 c35b2a607ac7acb9ead5107d991cd3cf7343196f
- SHA512 2dde5302c8a7773e51025362a9bff9470a3d6ba99fe39db34f7349d34fab4c6b21349592e4333112eb639209c20c3b715164dbf11b68c4586bf3a1dc2271610e
- TLSH
  T17501104E1062D3B70D4002853646E0DFF21E8AE3369E5490314D579F8606E7216F20EC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  clamd.exe
- Size 116KB
- SHA256 2d98a8e69cfd5e8a6932ebe732abcdd3a22dbbd4ca48d8be9fc4946b844e7cc8
- MD5 521dcd4c5a6f1933e2832b5768faf52c
- SHA1 ab5ed2b7044ae11156843cc824a514e95c1be79b
- SHA512 8e9cf6bf0f70a6c6b08f39eeeb8d31cd3d400135b69aa78000a9fff9f7cba06002e7ae1f9aedb5a0359e6811e364bb885b06a5c3db8f301c065008d8957aa575
- SSDEEP 3072:+D8aCRGSiX7QsYuzxPzkz6+8Ro8DM2Z6vs7GI7cYFO9FViDLM8NVe:gCW7QJYx7D+8RNQ2Z6vs7GI7jFgFViH2
- TLSH
  T1B6C36B92FD4A1865EE011BB162974BF3DB3BC427135202ABEB64CEB54D340D1E72A63D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  clamdscan.exe
- Size 76KB
- SHA256 c7844db3523895ee65de5a0ac104aa533e028e997cf7b2c6ca25a348d1033999
- MD5 82c5e113f6bc49d249e1847254cdedbd
- SHA1 559500ea387e1ac5d2445288a6827074f33b4d5b
- SHA512 d2525022f28aad5ae75230b7b4d7ec5b530955d988aa47e2cdf5986cbafb65dcf4f00672b207011086fd93bd6ef00146dac6e61f9e7d26952475e2ff78fef255
- SSDEEP 1536:HPvtCWB4+vU9T1cfMm8YS/FO1jFjw+iykbLM8uQSUV:vpvo1cD8V/FO9FViDLM8N5V
- TLSH
  T1DD7349A1ED4E0819FD105AB4629305B2EABFC4136353129F7B6CCDA54F312C6BB6983D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  freshclam.exe
- Size 128KB
- SHA256 291c8aa39966c45b999967cf5ac5ba9f41cd71200aed6633dae868efa9e8f4a2
- MD5 de9934468a09a2e9e09e80363cb21eb2
- SHA1 63a4b492e1a7884cded656a318d100986f739ae5
- SHA512 3d40cae3e9fd85e4986ced54de738d880d8b4e71305a242362034e1267d4a2409162305f3c09e237547e01ba82f6d35b14edf12fe6912bf364433297efec9c7c
- SSDEEP 3072:w8zvk+/bMcOwcSwAh+Li+HQ2gtgX5aqA8JIchW7veIFO9FViDLM8N+W:5A+/bMcrcKhQi+HQ2gtgX5NA8JIch+v7
- TLSH
  T18FD35B90FE590569D8101AB151670FF3EB3BCC576393428FA768CDB34B712E26A2E16C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  ico/ressource.dll
- Size 403KB
- SHA256 85e883fef7bea9b438c88423cd150291580b635a8321943f8867abf315a98d28
- MD5 cfee12ad654a201705a73081207c67f1
- SHA1 4018daa3eb89d365a8dad5c853908978e0fb9972
- SHA512 958e25d3727fa16eb7f3756e381ab993c2256f2374f5d7935f96f4fea54afd42f3df7c99115b870013ce1026797caa5949e18fbc520d13d26c6c61475f904043
- SSDEEP 6144:3k1CuAcc3BDQV978TzjFUYI0aw/I5uLd9skcyLB4wi6:3YAccxUV976zjFAp55uLd8yLj
- TLSH
  T127947B0A770CE616D4DC1A7486DED6B073B5FF51D8615A0BBAE87F1FF93328A1906280
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  libclamav.dll
- Size 3.2MB
- SHA256 b39a156b164a76fb4e701df0d2ae263cd4169f9c97670882dfd996d63e4721ec
- MD5 787379094325085da84b0807f1f6f0f8
- SHA1 52b00fb67cc9016343a0e06fa0db49c04e56038d
- SHA512 17e28e0275843ed2b5fe2b2c1e52ecc07012b22b1f23bab0531d93747d257d32c0fe5275ef75bed09523ddd4b782f92d61b32cb8c0fe969aff8a4e0d6c157455
- SSDEEP 49152:Rna7eOMnrVgPlUQQcrCzMGpqsTLN6LlysYYjY:Ra7Js62Txs
- TLSH
  T106E58CA9DF8F86E0D4464D7803B7D27F6B366E059364A1E3DB90EB74D9302E1407A788
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  libclamunrar.dll
- Size 64KB
- SHA256 c40e36d01fd6d38026e18e0ffc92e954b779d9f5d7e83d8e53856807696786e7
- MD5 bb50771cb48539ef7a535ec1a52cf39e
- SHA1 3ae1170198558a0df936714c5a1bd0092b9885a0
- SHA512 6aa0a8fd52c85710c924e5fc51406bc78b9da519400a4e0ca3da0d28c234a2e82f473d295649292d6ece6048a631fd22df302c4ae14ddc26d2f5db7e977715bf
- SSDEEP 768:elZ4m0NM+ipIUHSTiGrVXT6sY37AmUoXyRUww8SHQro8zFe3P:oZ0u+i2rVXZAAlUw9SHQrz03P
- TLSH
  T1BF534B0D9E5FD076EA050E74A5AA82E98FBC0D0BF3EA21FFDF919D8248711D900B4674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  libclamunrar_iface.dll
- Size 25KB
- SHA256 72ac671739f3197dcfa85728593a6438c93452438321031f1a93edaaaf02c7f6
- MD5 0672b8a9a1a5ff8b3f401b0118f90a5b
- SHA1 de2fd7498ef56cf5fa916e31b3d9626c05847046
- SHA512 2b2916e0de2286697528f6318566bbc82c73347f75b958097a3cf38d6c6387b3c0a37afc07541de449ba2ec8591ef56fd395978aef4ec8277078db6fc519c2ca
- SSDEEP 384:H3ixLk0rZrzKXpBrolyUM7pCDsVooSu8zQ/Ysy+++O5VMdrZ69UC9W+nh5:XuBFKXHNUM7pCDsooSu8zYw+++Ue+/
- TLSH
  T139B239109E3884B5D6620EBD74575FA38C6E43B3DBD550E3EF63ECE858309C2887961A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  libeay32.dll
- Size 1.1MB
- SHA256 9ba4e0dfa2492450cbe9ec4b3b4cc9b9e1d6b7b1647f0daedefc6a6640df9c34
- MD5 bf3eae26fc192547f9d7ad3a94ba193b
- SHA1 574ba74f411fd1f1dcc94a03e68b98439bd0feeb
- SHA512 b7daacf7c97af846f3cd2c4ad1c1e89a2c160413b48dc8e9393207dfa09b21254230545608c233d474736d50492576b532bd3a8520207104ece35574e76cb071
- SSDEEP 24576:txsxxSzQxlrEBkfTDVFIqvZNL6OuBU4PGrApojxOVTZ:tKS8x//IKZNL6HOrApoAVTZ
- TLSH
  T143459D07F7D199B2E88D567D6ABB567F4A339A110329C6C38EA039829C311D1A73F3C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  msvcm80.dll
- Size 468KB
- SHA256 7dcb3c45938d31854e46b5e5b0e16d538e29230d1bc81086d40c8db3bdf510bc
- MD5 1d109ed0d660654ea7ff1574558031c4
- SHA1 04c690eb322e236a9bed2937a04430c6fda3b13d
- SHA512 806cb75368b38ad6e7de3c41e600f537dadf11c2def3b5171818945f2ee5a495cb143198e4eb80d0df5f964d8bbae09630869a8a6cdacf67d2c3690df457275a
- SSDEEP 6144:O6KTZsHDwx0TCAQpFTfnPyFVrCqq/KrnahQ+Nnq0B/aNOjMQpyn:ksHDG0TM6sKGhQ2nq0iQ
- TLSH
  T1CAA45C5E5A574C3AD9D62333F653830987BB78A9935277138207E16C3B403C9EAC6ED2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  msvcp80.dll
- Size 541KB
- SHA256 372af797353f9335915cd06d4076bab8410775dcaf2dac0593197d7c41bbffb2
- MD5 0b3595a4ff0b36d68e5fc67fd7d70fdc
- SHA1 973614ac9622d5ea9cdd68febce3258d196408b6
- SHA512 e191de0236e05e0bb198c51e2f630b56b833b868383e7ab0bbfd91010fa57a9402364e1082c0f267b1e24789f6d7e6d0253d2a932369f469588eec6ada3f48be
- SSDEEP 12288:rZY4lOHMwLwXBt+iaKst/Ua/hUgiW6QR7t5j3Ooc8NHkC2eW9:rZY4lOHMM8wifstjj3Ooc8NHkC2e6
- TLSH
  T1B8C4E72337438EF1E48273F176C50322A7F7BC654625B31392DBE5252F9A28D6573AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  msvcr80.dll
- Size 617KB
- SHA256 c3ac989c8489a23bb96400b1856f5325ffc67e844f04651ea5d61bc20a991c6d
- MD5 c9564cf4976e7e96b4052737aa2492b4
- SHA1 43851fe4644c0a1eb31fe80f427777f1f0015efa
- SHA512 8e9817ab398a86af6982d39fed018ff5282f60c5330dbef6417cfbe73731d8503c63da32107d948cc1eba14dd30aab614c7c858300e4f79ca418dc42d353f9c8
- SSDEEP 12288:Kxzh9hH5RVKTp0G+vphr46CIFt0yZmGyYGK:Kph9hHzVKOpRFHmGyYt
- TLSH
  T157D4CF51B5E3C472D0B201B5490ADB3A9A3BB9504638A8737BE60FCE4E787D1FB17252
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  snipedscan.exe
- Size 76KB
- SHA256 c7844db3523895ee65de5a0ac104aa533e028e997cf7b2c6ca25a348d1033999
- MD5 82c5e113f6bc49d249e1847254cdedbd
- SHA1 559500ea387e1ac5d2445288a6827074f33b4d5b
- SHA512 d2525022f28aad5ae75230b7b4d7ec5b530955d988aa47e2cdf5986cbafb65dcf4f00672b207011086fd93bd6ef00146dac6e61f9e7d26952475e2ff78fef255
- SSDEEP 1536:HPvtCWB4+vU9T1cfMm8YS/FO1jFjw+iykbLM8uQSUV:vpvo1cD8V/FO9FViDLM8N5V
- TLSH
  T1DD7349A1ED4E0819FD105AB4629305B2EABFC4136353129F7B6CCDA54F312C6BB6983D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Creates a file in the Startup directory

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32