Overview

overview

10

Static

static

3

e778f61c95...18.exe

windows7-x64

10

e778f61c95...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e778f61c9564e8c38dab781760f887db_JaffaCakes118

  • Size

    2.7MB

  • Sample

    240408-prk6face4z

  • MD5

    e778f61c9564e8c38dab781760f887db

  • SHA1

    11954f1cb939390cb94f5652e41a6f69e2d12d37

  • SHA256

    f23944ea67055bcf3fec07b05cd40c63a00f70fd0cec319a7052129aa3ebf4d3

  • SHA512

    af4ec0d66091e0de79ab8e25288e5651e1759098cdfaf6e3f2597c13cf4f12423211e55558a831f4250628b1952beb665fef8dcd7aafde23ad2cc8057bb25800

  • SSDEEP

    49152:UhhsJ2jQ2safBxOtgbekECbgUWtSu7liyyLpLZFcN1sbX6T2CyReacK:e1bJfBxOtg6kEMgQuYyyLpF2N1tVie

Score
10/10
ploutusatmbackdoorevasion

Malware Config

Targets

    • Target

      e778f61c9564e8c38dab781760f887db_JaffaCakes118

    • Size

      2.7MB

    • MD5

      e778f61c9564e8c38dab781760f887db

    • SHA1

      11954f1cb939390cb94f5652e41a6f69e2d12d37

    • SHA256

      f23944ea67055bcf3fec07b05cd40c63a00f70fd0cec319a7052129aa3ebf4d3

    • SHA512

      af4ec0d66091e0de79ab8e25288e5651e1759098cdfaf6e3f2597c13cf4f12423211e55558a831f4250628b1952beb665fef8dcd7aafde23ad2cc8057bb25800

    • SSDEEP

      49152:UhhsJ2jQ2safBxOtgbekECbgUWtSu7liyyLpLZFcN1sbX6T2CyReacK:e1bJfBxOtg6kEMgQuYyyLpF2N1tVie

    Score
    10/10
    ploutusatmbackdoorevasion

    • Detected Ploutus loader

    • Ploutus

      Ploutus is an ATM malware written in C#.

      backdooratmploutus

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks