Overview

overview

9

Static

static

7

fb12295af0...18.exe

windows7-x64

9

fb12295af0...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb12295af004bf9f90161dfd4df4d98d_JaffaCakes118

  • Size

    7.0MB

  • Sample

    240419-yva93seb56

  • MD5

    fb12295af004bf9f90161dfd4df4d98d

  • SHA1

    483f69677561f4be57de1983316dba1c8f7080b2

  • SHA256

    d3a25c8c8b29a8be468f3ed792fd7767ae6aafc12059a873174d421857cc0da4

  • SHA512

    0d80c65c716fcd67e967e8a5b0d86dd9df0054de3c247ae455c71653768a72f5edb346c9f852eb88fc5f275f058ba6fc9f67c02e88e012751da2e55b5dcc6b6f

  • SSDEEP

    196608:dgCqfmTdhCbVUbz2eV8ld98BlON2jnbNswvBXvowJgzl7GSZn7ftm:dgCHTmb6bzI90jVvBXvoww77rc

Score
9/10
agilenetevasionthemidatrojan

Malware Config

Targets

    • Target

      fb12295af004bf9f90161dfd4df4d98d_JaffaCakes118

    • Size

      7.0MB

    • MD5

      fb12295af004bf9f90161dfd4df4d98d

    • SHA1

      483f69677561f4be57de1983316dba1c8f7080b2

    • SHA256

      d3a25c8c8b29a8be468f3ed792fd7767ae6aafc12059a873174d421857cc0da4

    • SHA512

      0d80c65c716fcd67e967e8a5b0d86dd9df0054de3c247ae455c71653768a72f5edb346c9f852eb88fc5f275f058ba6fc9f67c02e88e012751da2e55b5dcc6b6f

    • SSDEEP

      196608:dgCqfmTdhCbVUbz2eV8ld98BlON2jnbNswvBXvowJgzl7GSZn7ftm:dgCHTmb6bzI90jVvBXvoww77rc

    Score
    9/10
    agilenetevasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks