Overview

overview

9

Static

static

7

e2cb3426e3...18.exe

windows7-x64

9

e2cb3426e3...18.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    e2cb3426e3e5139627797016c96b213c_JaffaCakes118

  • Size

    8.8MB

  • Sample

    240406-sb456add64

  • MD5

    e2cb3426e3e5139627797016c96b213c

  • SHA1

    c7cbe7e247180cc52058a68a488eb794d9ba7e2d

  • SHA256

    609cb4213cfb12be9dc11b15412d67db054f6f9cabb285649cc54138b216247b

  • SHA512

    c69d7765e727632173baf050086576bcad7fc1d8f19c07ab74a10232944f39e5e39c14e70f17cdc2bdcbfb58a52f57919ea1dd911f84774c70761475a3afab2b

  • SSDEEP

    196608:vAg11VzahUJk+k7kU3uDFF+8hiXZjHFte/qnsRcgPy:v/9am+AlJ4RdHW/1coy

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      e2cb3426e3e5139627797016c96b213c_JaffaCakes118

    • Size

      8.8MB

    • MD5

      e2cb3426e3e5139627797016c96b213c

    • SHA1

      c7cbe7e247180cc52058a68a488eb794d9ba7e2d

    • SHA256

      609cb4213cfb12be9dc11b15412d67db054f6f9cabb285649cc54138b216247b

    • SHA512

      c69d7765e727632173baf050086576bcad7fc1d8f19c07ab74a10232944f39e5e39c14e70f17cdc2bdcbfb58a52f57919ea1dd911f84774c70761475a3afab2b

    • SSDEEP

      196608:vAg11VzahUJk+k7kU3uDFF+8hiXZjHFte/qnsRcgPy:v/9am+AlJ4RdHW/1coy

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks