General
-
Target
4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118
-
Size
124KB
-
Sample
240331-exfg2adf6v
-
MD5
4cea5d8cb3e0a17e942812e31667120a
-
SHA1
c526373cc21495053cdf3ff735f10e4f031659b7
-
SHA256
be4448eb3e5f348051538b82b3e9b63191da49d028e6c5f2b8de4cbc6135c84a
-
SHA512
1eed5b3fa630ca2e4998e5eae400cab82a2e65005107f9bae0ae04a7ed7b32373ffaaf486578acca13bf74c38193e62fbb51da381555fec8d45c10a40cc962f7
-
SSDEEP
1536:LEuul/7WYt61BPnueWzlCd46+Ml3ybnWbHPs:LEu4/7Rt61BPue4+46+s5HE
Static task
static1
Behavioral task
behavioral1
Sample
4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118.msi
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118.msi
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118
-
Size
124KB
-
MD5
4cea5d8cb3e0a17e942812e31667120a
-
SHA1
c526373cc21495053cdf3ff735f10e4f031659b7
-
SHA256
be4448eb3e5f348051538b82b3e9b63191da49d028e6c5f2b8de4cbc6135c84a
-
SHA512
1eed5b3fa630ca2e4998e5eae400cab82a2e65005107f9bae0ae04a7ed7b32373ffaaf486578acca13bf74c38193e62fbb51da381555fec8d45c10a40cc962f7
-
SSDEEP
1536:LEuul/7WYt61BPnueWzlCd46+Ml3ybnWbHPs:LEu4/7Rt61BPue4+46+s5HE
Score10/10-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-