General
- Target jaffacakes118_Trojan.Win32.DNSChanger.ueb.44011ceb23845d7661dee777d2b6b7de
- Size 192KB
- Sample261018-z4f3css12m
- SHA256 2bbb6f476b32c5afabd570306b1f7675b0c32348e9a4d624c07e569c58111ba3
Score
7/10
Malware Config
Targets
-
- Target jaffacakes118_Trojan.Win32.DNSChanger.ueb.44011ceb23845d7661dee777d2b6b7de
- Size 192KB
- SHA256 2bbb6f476b32c5afabd570306b1f7675b0c32348e9a4d624c07e569c58111ba3
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies WinLogon
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/StartMenu.dll
- Size 6KB
- SHA256 a5c5012191015659684fc19b5e8ec7d33837b25c607f0f9dbfd46c10b8baeb17
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8a8bce943b78093ecd86a42c203931ee625f445acf5cb5b705e3b7eaf29c7110
Score3/10 -
- Target 01.exe
- Size 64KB
- SHA256 1c0f271fdda1c1c548bed595414ac25d1153d63391ed8470a41c8befacd2e370
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Modifies WinLogon
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
- Target $TEMP/UnRAR.exe
- Size 90KB
- SHA256 264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Uninstall.exe
- Size 51KB
- SHA256 464501b3de7998f744445fc8d2726be863bcf3664890626b7d76eb899c9fa1a9
Score7/10-
Deletes itself
-
Executes dropped EXE