General

  • Target

    f24a3aa2934b44624a4ddc6eb3e2830d_JaffaCakes118

  • Size

    6.3MB

  • Sample

    240416-azm8faee6y

  • MD5

    f24a3aa2934b44624a4ddc6eb3e2830d

  • SHA1

    f22348ecae7764939babdd8072ed9552ce2bd6cb

  • SHA256

    3d09c25a74b1bcfb37fc1ac38ca9a185b5f4ef47715fb4f27d1095ad27b9fd51

  • SHA512

    0fc7fd55c29af8a3ce3e190777930b97a53e2286c3f250d636ae91362eedc73a81a9db290b95758cb0fac8cf0904199547d20cc4a72f6c146d385e09219c4f21

  • SSDEEP

    196608:pO4tmB9vV8ld98BlON2jnbNswvBXvowJgzl7GSZn7ftm:I4M9M90jVvBXvoww77rc

Malware Config

Targets

    • Target

      f24a3aa2934b44624a4ddc6eb3e2830d_JaffaCakes118

    • Size

      6.3MB

    • MD5

      f24a3aa2934b44624a4ddc6eb3e2830d

    • SHA1

      f22348ecae7764939babdd8072ed9552ce2bd6cb

    • SHA256

      3d09c25a74b1bcfb37fc1ac38ca9a185b5f4ef47715fb4f27d1095ad27b9fd51

    • SHA512

      0fc7fd55c29af8a3ce3e190777930b97a53e2286c3f250d636ae91362eedc73a81a9db290b95758cb0fac8cf0904199547d20cc4a72f6c146d385e09219c4f21

    • SSDEEP

      196608:pO4tmB9vV8ld98BlON2jnbNswvBXvowJgzl7GSZn7ftm:I4M9M90jVvBXvoww77rc

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks