7dee7806a3803c89e2277d7774309545b23926456e79f5e19b6467220954a174

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_7dee7806a3803c89e2277d7774309545b23926456e79f5e19b6467220954a174
Size 4.1MB
Sample261024-a5sp4sdh79
SHA256 7dee7806a3803c89e2277d7774309545b23926456e79f5e19b6467220954a174
MD5 3b361177300dc81a14433d384beb6dcc
SHA1 5e6022074f9005801e2b68128663983375d4c553
SHA512 27340cf096ff2308d2893b74293eb0567ddf857115f111f75abb6c1fba1108d2b0e68b651d35d69271c3b7aed70f5d1d81e75371b7081df412026bbe5e039db6
SSDEEP 98304:qIDrDyN8hXG/BAdU1+wKy73Z57XLxvZOr7gTKr6jVyk:q+yw2+G+wKSZ5LLpG7gL
TLSH
T19F16330A9EAAD2E7CA579073D0E67E3178F45D22E77D501F1A20123001B7076A77ADEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  _Conslt-Oria0I1G4sspm-7252XFOVNM9Z5070453.exe
- Size 2.6MB
- SHA256 98e56c5f902fb825f6f122122ba6a2a0febee1e582a462f74dd1d99b018bf7c0
- MD5 cfbd8d062e9baa98737a0260996f48c6
- SHA1 7bc79e8bbff363b41fd73f9bea102ddc4a404cbe
- SHA512 4335a0e58eb853c6b113f28f306acf2e4cddf130f98e10e1e85e6df65addeabee422530e46ceea07a50119de8f9ef48a1ea9a1c6ebd7e46ac5d35af46ce98b9b
- SSDEEP 49152:1jPP4L8GNZGMyYDSHolOO7oxKQx9Ov9MAo0wqUh9YGnbAYpkQKDLk9KNTY6pbNns:1zQL8GNZGMLDSHBEGK+9Ov9MAo5qo6G4
- TLSH
  T1C2C51A1DA34141B6D97304F156AB2BFB8B346A395420D50EEB80DE1DABB7DC1FA1A313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery
- Looks for VMWare Tools registry key
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  dupfdll.dll
- Size 985KB
- SHA256 fad1e9d507c7021a62998a547ab53b3ee438846f7ae753285fdb3917dd2dcdfa
- MD5 e882ee4a643b00871c98bcfe4b4d7cd1
- SHA1 e6ae8be61928e1279190b0df28ac8ad94f3ac29d
- SHA512 f7e5e8b7cb8a74d502e3853abfeb9eedb4ae8486a5656226e92b48e6af1fde6ef31bec55d4d4bbdc28bc4496999e95eacbbceda7b1fa9000e59e491480ecae9d
- SSDEEP 24576:NULN6sC5vqMYmVsMKJhG+8cYtd8J1sAN703TnPNJS:yLN6Z5vassHJhG+R703TnPNJS
- TLSH
  T1C7251A5DA34241B7D9B301F0165B2BBB8B3096294424D91EAB80DE5DFF779D0F92E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  mingwm10.dll
- Size 6.0MB
- SHA256 1b2fe30c5bf57f9623efb34688580fe5bbb2c55351c5a07a6c4313bb6faa29f1
- MD5 f0f428f7d9d4592ff018fd20b81d6134
- SHA1 c571888b27c1bd42469976d4be43438d0c64b638
- SHA512 20dc124d5066d9b4137af6aee2f7969cd09cf24ff2a29e8f80002394af4e068615ce349f8c370c7232c3df4ae6559d9773dcd3ccda9ddf8f9edd92ccb104d965
- SSDEEP 98304:us0Sjc5B5ZDU/KQxcJg5MVj5DL5TVVVdyrNT9:usA5Z6csMVVxTVUf
- TLSH
  T1BB567E13B384653FD4671B3A483BA654683F76B13A168C9B6BF4094C8F39A813D3A747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  ~/buovg2.xml
- Size 46KB
- SHA256 992484d2d4aa3d9522406823c5fafe7809be48ee4bc13733bf14eea333c61234
- MD5 5e84f38f9b3b0b3cd01babaadf33abc1
- SHA1 d2514ed1befed05329a23e648f50f9344e246a61
- SHA512 5f7d308fb98cefbdd6102fb93d3ead85f3475a57eb846763497b6bc1a5186eb645cec7e100c609b8af969e2d4a0237affffc703ee2efbf1d2cc8192aecb55ddf
- SSDEEP 768:wiO8S6pjf11dUBBBI4JDOE7YeQ7yx5Kri5fDnuGGHdSLJ4:wixzpFURPJDOE7lQ2KrilbuGGHYy
- TLSH
  T1BE235B66AD0040B3FEE10636EBFE9C8A5EBC61161B2CA0E72777409D6D546D36B30B46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ~/kjxps1.xml
- Size 33KB
- SHA256 4653e55b1186b8198e72b198c49643c7e7d00bfed3520f360cf1879c8c27760d
- MD5 55f1b951724adc8d47a909cd6befe88f
- SHA1 13d012694cb5c69161dc6f53c61c297dccc3ee56
- SHA512 cdbf3a7c8ce9393f0f8d313ade2169b8441a1d859546eee8b6143b75ae636ac71723a16af4dd1456d5ae342ca76959cffe7242698a47a91840f82321e5d79ed9
- SSDEEP 768:44Wy+V9/3uhfPsCkhv3RoQA45YiQbj5ALS:QTV9uhfPohv3RoQA457y
- TLSH
  T13CE27C4BD7D80855D47B9670A8E34A1BEAB2F9105F6283CF2220815E0F627D13B7D7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  ~/matv/kkfm/xrlqto/adrst/acyet4.pdf
- Size 19KB
- SHA256 1bb9dcb4941df4c2975a03a6ef71cbadfa31117fe19b56fdc8c3b12be714c414
- MD5 12b5eb021903bbf1084fb64b0acf614b
- SHA1 da73294db8b2e569a89e136afa6837b65e143d0b
- SHA512 add97a632391450beb80e8148a889a76c9424bc497d816291e1c87bae0b1ff3878f0cbe3e89dd7ade3db03248dc6c94cc9755b81b855853b825ee60754dd685a
- SSDEEP 384:9Pv9G/z//S03wj/hSlBaDEX4XGkWl127Zwc35N:9Pv9MwVuUtfD7ZN35N
- TLSH
  T1C1929FB3E6E41C8CE8828A579D693DD4449DF023D3CC3CD124B94781B695E3DBA125EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ~/matv/kkfm/xrlqto/adrst/cirkqu8.pdf
- Size 25KB
- SHA256 3176dfdf46fe6b350ecfee47ca0e24fda18cfd972752903ec4e40d056f1e3f1e
- MD5 12590d714ab1ea408ad7311334828f27
- SHA1 1f18d0e38ba02e58c3f782df0dd8330e1eeb3d7e
- SHA512 b90b3df644ab3895b50ce762ad1cd10059363fe23947f5e064b5072f4ecddd0c350fa9d0c84e5648bd3d9a14ed74aff6e750bed0c2f9563381a03018de02b3fe
- SSDEEP 768:HNKhMN8MHi0CpVxevSBn924anU6FFqKIU9R:HNg6G0CPISt9unBFpH
- TLSH
  T1E8C29E192007D895DF5387CAFF1D1662664D730F52A0A8A27D2C8C168A97FF8F61D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  ~/matv/kkfm/xrlqto/adrst/kfen7.pdf
- Size 79KB
- SHA256 8432848916b62e651f7bc10eedef9dec0087f6ebf022e128cd640171033c12d1
- MD5 b3fc50eac6c21715d016bf0e45402547
- SHA1 d72b82c279841174f65e15fee717cea005c40e27
- SHA512 37cdab027317349c3d4aeaf5009a3a3d6187987ab6106d29ec7c0e641e3a4cce131bc2312a63c45c3273e14b0b34067d115cad79af90016ff000b5fc9114cd8d
- SSDEEP 1536:iISV+cfeY/y8SIWI2MoE98zu7KKHm3N03Povj2cvXU:iBVReY/yv8loE6cK2m903Mj2QU
- TLSH
  T1D0838D53CE099B879548C3F97F172D6C2B1D330DA9C57AFE10220F8ABF989616C5906B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  ~/matv/kkfm/xrlqto/adrst/ksxfo1.pdf
- Size 1KB
- SHA256 4fdbed98b298ed09be27d9e0ea6f82c09183cd968d023c26a5effa60a2ca32a6
- MD5 c65d6f20d5961398a84ad0f38c70b941
- SHA1 87549af4c34881c5592cf262c1ecf1e1b5357297
- SHA512 930f83fbe6876487ffc440bc6ccba3ee0ec2bc11c455178bd501be11bfdb77b23ed4ec6e02cf955ad2850f78dd4394e51254f8115681bb487dd4836f2a70083f
- TLSH
  T18E415414E9C81CDCE4E64A437B0FB857B969710315ECA5D1016CD20F908DF95A9A3A27
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  ~/matv/kkfm/xrlqto/adrst/lfyb3.pdf
- Size 1KB
- SHA256 473a670c7bcb56d7dea0aa53e7dc6129fa1b074f006bde8aa89fd1df9eb850c5
- MD5 dc3211db2ed08ac2b83b9e9223c4fdc1
- SHA1 d026aa69735c640a4486ac99eee6c776cc80f7aa
- SHA512 84108f8224316feae0b46c8b991a0f6b069ba40d3ee8edc0ec5e7461f4fa4f77e392ed04c7999f64c228ea1660f40b777299295daed4b1036621ebd2b8e331fe
- TLSH
  T11A414214888C5CECE4A65342BF2FF88BB579724316EC79D5006DCA0B808AF99AC5331F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  ~/matv/kkfm/xrlqto/adrst/pfxof6.pdf
- Size 41KB
- SHA256 99b16b54e191aa926f7b7c305b31440b696ef038357d1283a1a3939ad1e6b08c
- MD5 b6658bbe5cc145192adb4dbe87333b3a
- SHA1 94730a85e41c8ff76d194e2463f17bde3567a958
- SHA512 e29f8543820ec189a97d36c8e0bedb1744af0f16d1b48979c025de7d55c8daab9b648e96323a1f54abe13da203cbc0e2c0c464bfd020fac57db6eb24cc069d00
- SSDEEP 768:j9h+k/q5z2NgW0Qz0IQc4rnPF1N/JE9J/xE+YlO71sSA3yXUMkcqKIAdpLW:j9T/qdY0Qz0IQc6PFr/qZhY871s9CXWL
- TLSH
  T1A113CE561003C4B5DA07ABE6FF3D6C42452DB36BE5DC99A22C2CCD125A8BFE6F5490C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ~/matv/kkfm/xrlqto/adrst/pkmj2.pdf
- Size 33KB
- SHA256 56d870a75385026c575569f0f0d89d757d73e827c1b9f890b4da7d5c53516bae
- MD5 70ebf93e7bbe30714bcf9ecb40760610
- SHA1 759f9713986c8b9f9ee2debd83da6adefb8627cd
- SHA512 e35368ff20401cf1fa05057dd1344e202bb27a1faffaabb726a570b2893aaa3a9689f782a3c604c0dda45c0f4b5d4df3ff6dc17064f5223f6db8c935246d23e2
- SSDEEP 384:QnY3q6OvFOx03wj/hSlBaDEXqGJWl127wwc35JJEccWLcy5hRxoN8yT2zk+M+5:QiNswVuUWD7wN35wbKtSKP4+v5
- TLSH
  T19DE2BFB3F1F518CCEC8647468A593DE9085EF127C5C83CC220798786A585F6DB7225DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  ~/matv/kkfm/xrlqto/adrst/touddf5.pdf
- Size 22KB
- SHA256 224bd6620702bac590613ca035bd19580d9236ff37788b533e1595237a70b594
- MD5 8eabf381f589e9110ac0eec81d7e95b1
- SHA1 d40aa7f374a2ccb6092e0c3ec909233ce06c1ea4
- SHA512 e67090eb019d2ba4ed27c606488a69d4a7a981924e7e4eea1d9a8fe00ffe55b9d081523c59fa05738827f314b7ade122c0c2f020a37e39e55bfa48e49183b00a
- SSDEEP 384:4evTt6zbgNIwi8903wj/hSlBaDEXbkGQWl1272wc35j042:4wt6/t8IwVuUkAD72N35i
- TLSH
  T138A209B2D9A41D8CDC82CF8A44A53DA4046DF623E2CC7CD454B45F85B98DE9C7B131EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  ~/matv/kkfm/xrlqto/adrst/tyug9.pdf
- Size 21KB
- SHA256 0893250096e4e2eace96e4a1605b2d13348770a0339a7a30598a967df5e5ba8e
- MD5 1a0dcafda9cd9664df53da25d8b0e2c7
- SHA1 27a62e71dcdddf670411f5f433b23b660ec70c85
- SHA512 b08f22f0c79e6969fc1d4fb30aca30adda00450fa760cf19c85b3c453cacd44660284437bbaa4fa80316b0d40f3f8f22d95f3cc245a38d55ea0d900f81421810
- SSDEEP 384:szMb0ccsPH3VpFdH9G5bBxJYfDx2RbH1EGRAzyw6N7V2lCIas/xnOh3q4q:JAiXVpFeyabH1CzRcQwIdN
- TLSH
  T160A2656E2763C998D8152B8DEA9467869334333617404F31FBAD2604D7C4F17BD5E8CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  ~/matv/kkfm/xrlqto/adrst/zkca10.pdf
- Size 38KB
- SHA256 fb83dc5c94b5356bbf08a5c3dc9efa6d8812b270132151368d4889f4d926e6da
- MD5 617d685270333d15dc6396c6fbc137af
- SHA1 83284779920af6efdfc446c93cd311c2e61c38f0
- SHA512 5e0fb70babc5bd019665e61bb09dc33a56bea963703ed8d94568b89b2cbb1f7ab28a51954dac4ec263ac89f4023e3c55cfbed488147eb7e9c36f5cc57ea363f9
- SSDEEP 768:L6IlCJijP4KMByHhpNEOcpzI0iZGIqwFxMO1DdUD3mxDYvz4VdmfiIvftKu//31v:L6IygwK9BpNOzrGMmxDMz4V2vfvPFuQl
- TLSH
  T13403E1B06231B809EAD7675DBFA13D49458E3A42CDD128C3D8618AFF7574AD39862EC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks for VMWare Tools registry key

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30