Overview

overview

7

Static

static

3

nmap-7.60/...32.dll

windows7-x64

1

nmap-7.60/...32.dll

windows10-2004-x64

1

nmap-7.60/libssh2.dll

windows7-x64

3

nmap-7.60/libssh2.dll

windows10-2004-x64

3

nmap-7.60/ncat.exe

windows7-x64

1

nmap-7.60/ncat.exe

windows10-2004-x64

1

nmap-7.60/ndiff.bat

windows7-x64

1

nmap-7.60/ndiff.bat

windows10-2004-x64

1

nmap-7.60/ndiff.py

ubuntu-18.04-amd64

1

nmap-7.60/ndiff.py

debian-9-armhf

1

nmap-7.60/ndiff.py

debian-9-mips

1

nmap-7.60/ndiff.py

debian-9-mipsel

1

nmap-7.60/...te.exe

windows7-x64

1

nmap-7.60/...te.exe

windows10-2004-x64

1

nmap-7.60/nmap.exe

windows7-x64

1

nmap-7.60/nmap.exe

windows10-2004-x64

1

nmap-7.60/...93.exe

windows7-x64

7

nmap-7.60/...93.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

DiagReport.bat

windows7-x64

1

DiagReport.bat

windows10-2004-x64

1

DiagReport.ps1

windows7-x64

1

DiagReport.ps1

windows10-2004-x64

1

NPFInstall.exe

windows7-x64

4

NPFInstall.exe

windows10-2004-x64

4

NPFInstall2.exe

windows7-x64

4

NPFInstall2.exe

windows10-2004-x64

4

nmap-7.60/nping.exe

windows7-x64

1

nmap-7.60/nping.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc2272ccd39970db0c57f0cac8e750a0_JaffaCakes118

  • Size

    19.0MB

  • Sample

    240420-g7ysgabc6w

  • MD5

    fc2272ccd39970db0c57f0cac8e750a0

  • SHA1

    0ad299baf7ee4d62b91f252f726a86f4a0970e6a

  • SHA256

    f06b9edda0a7249ee633ff2b469853623e307b981ec43e53ed28bde6704bcee7

  • SHA512

    63f01a24ca7b51f76f7c9199d8587f146738bc5768d69f1efd94c50a6ced97e11ae202834b692f31b317c7151ea81379c1576e0d003f5a89d504aeeba627bf0a

  • SSDEEP

    393216:qiaubXCfdN3ZqbiUcwy9bQ+LMIQHLOX3C03LzbbNy:qLubXCfdlQbiUcKcMFKXS03LfM

Score
7/10
linux

Malware Config

Targets

    • Target

      nmap-7.60/libeay32.dll

    • Size

      1.2MB

    • MD5

      f88c2a039c9f143ef5a063cf2756278c

    • SHA1

      a9e044e560f0981378b78ba70ef70c8786340f78

    • SHA256

      718023119f84e976dd02b2b52886af88efe8812dd1e33f09d793044588393714

    • SHA512

      5a37d73feb76f1d129dd6499c03366f52d2ce28952f8152e54319820e48a3115f3fdfd9bf471d658e7a9a7019375c375ad50f6f9018ac61f11fd6ceba102e94b

    • SSDEEP

      24576:WPt+KpPSB7ol/I4WtX+KB802+rD+ULxjvNJZsjfvpvCshzBqfy6stPUbqGV6CqRX:+qc/IsSnhxZGv5DzR6stPuqxJhqs9

    Score
    1/10
    behavioral1behavioral2

    • Target

      nmap-7.60/libssh2.dll

    • Size

      148KB

    • MD5

      8420802e447c9d49b69ee3a344284609

    • SHA1

      a0b10a12efb955b4214aca595f4cb803099a3eb5

    • SHA256

      63fde79687ffb9e602c2862eaa97747b8d17305b4fee9483ec19f0f7ef671211

    • SHA512

      27213d36a366f3cc93a5d2bdef71b42d7d4d290aff88763dcb0837ba6c1a11ce4abc9df39927e0a57cd39a5f54d962e5171990a91f7c6a4ecb0dd8c3848fd6fd

    • SSDEEP

      3072:wwVNzokQtBJEYEHIwaNJbZwwOyDXb0+er4e1dHqZuRGltH:wwVNzozmYEHI3VbXb07rv1dHqZuYH

    Score
    3/10
    behavioral3behavioral4

    • Target

      nmap-7.60/ncat.exe

    • Size

      418KB

    • MD5

      d07af43ac400540efb961f06b26b615e

    • SHA1

      0cf60a40509f98450c7d581a3c5039cd715d772e

    • SHA256

      6a5aa0ae20943594ec1e56b4e3e756f96f500742949efb00cb2b7c068e643766

    • SHA512

      ff74794095dbba015d2c40ac2aa1efe1c830f07f6d4aca4716e93b8d3f059e7bf1eda2e1e86ffdaa6c502f9d39cee710c72f1480693e7e4aabb233986b0df7eb

    • SSDEEP

      6144:m5ngo8JWEjbhc56Wv3IQkdcRgaoZfs8/j+c/npj5o/W04mydOOVvfOO0:m5ngoWj1c56Wv3VslsmnpjS4mQH0

    Score
    1/10
    behavioral5behavioral6

    • Target

      nmap-7.60/ndiff.bat

    • Size

      1021B

    • MD5

      641a44e6f1b037d6ddef18a2b490770f

    • SHA1

      a9ee957cb8c3901ddbbf5dac478193dbb98024f5

    • SHA256

      0fcab43296a83fde5f039907d140c7a7bc9e6b36a799882140e47015bb3217de

    • SHA512

      042bb739fd86d084b223a6c3edd88ec795c5f22b725c5ac288c5eea1bef7e2e6684cb669f1f540098612128d06a01d694012a42175c90171a0e2db69d4d1e6d1

    Score
    1/10
    behavioral7behavioral8

    • Target

      nmap-7.60/ndiff.py

    • Size

      53KB

    • MD5

      0bfe73c8929520a4193a43e72f99a737

    • SHA1

      e081b0141a3442b399f9b86941c087b6af7349bd

    • SHA256

      ccb7db928f97d9619948c65a602cee20fc0d4ed37016993023eead0948fe7429

    • SHA512

      e18c4754e30448649c1509594bf48945a1735519cf1daa07342379f6d4bfd9ac6aca57d575d14dd778b3a3b23290875c44328c621a4d5d67a245d2d64a90ad94

    • SSDEEP

      1536:WZdFd8Ydgk7DZi7puMxJOtpahiifEDyFj86:6dFd8Cg8i7puxtpahiifQyFj86

    Score
    1/10
    behavioral10behavioral11behavioral12behavioral9

    • Target

      nmap-7.60/nmap-update.exe

    • Size

      2.0MB

    • MD5

      745d616d119ae747900e0a644c48a6dd

    • SHA1

      1f4161b9fef98209e530faea3bbafc15987489fd

    • SHA256

      779d69277301c16078931b1f1ea4321e20ab3d5d6451e75a8971e2baa79e8618

    • SHA512

      422974e81004b2345417c1e5eb3e10473896c491ef2718361b6f4baea16646669459625ca21890323f02e1e60dd695fd496817c5d28eab4636c03b5966b372e2

    • SSDEEP

      49152:/aEXQj18KH2fnTXhNM6qpYK7BFzTJPdTKncO:/aEXGunfnTXI6qpYKucO

    Score
    1/10
    behavioral13behavioral14

    • Target

      nmap-7.60/nmap.exe

    • Size

      2.5MB

    • MD5

      773f7305c65f4a7c4c33592337da2cbe

    • SHA1

      0f9d6a2a8932a88832c139bac63b7cdafc9fa6df

    • SHA256

      c2d9afe9a86d5aecffe7d01a168377ee8019a4dfa3ad15bc355995ee9e953105

    • SHA512

      942577fbc68b285fdd7e18704a55ff342fb6d2f18644b56a4818805752a8641d75195c538db93346f2054d50c08142dc3201e7fe09de1cc88a858391dc0be773

    • SSDEEP

      24576:DM2yQl2R1LB51bJxOz8fMtrhgZXWaPI3skhTO4j0nAnGFxgFPPPPPPPPxm:DcxzGZhG0lTO4j0nAGrgPm

    Score
    1/10
    behavioral15behavioral16

    • Target

      nmap-7.60/npcap-0.93.exe

    • Size

      715KB

    • MD5

      8faab76aa24d99b1e87f61c8d4dd3f18

    • SHA1

      41f206ca290afd00bc019afdf485d2704483077a

    • SHA256

      c3757e7f49bd40012ef9cd320568c401bad1ba1843a4055b11bebc2f10bd83ca

    • SHA512

      f4c78000a1d9f7930836811578715e3abbd7fc52607f9e96d8ab3d25f35bfb69a8e445d2f32d9741607c4ac2b71b992e1b53d16b3dd450e3bf8322be123dc9f5

    • SSDEEP

      12288:i3Lb6z7uM0bXuhuPeaPItATTaFO8ejup4cSUcDHWh9u/Qhj3fU3aqMzLjeIJVMwo:i3LaqMoje4ItAyc81pMUhQy3fU5KLjru

    Score
    7/10

    • Loads dropped DLL

    behavioral17behavioral18

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      d753362649aecd60ff434adf171a4e7f

    • SHA1

      3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

    • SHA256

      8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

    • SHA512

      41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

    • SSDEEP

      192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo

    Score
    3/10
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      56a321bd011112ec5d8a32b2f6fd3231

    • SHA1

      df20e3a35a1636de64df5290ae5e4e7572447f78

    • SHA256

      bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    • SHA512

      5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

    • SSDEEP

      192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8

    Score
    3/10
    behavioral21behavioral22

    • Target

      DiagReport.bat

    • Size

      1KB

    • MD5

      aea95fefd7081c61e4700d614d68c579

    • SHA1

      f4052c3419578b04a96c1acc6a67097db4729d53

    • SHA256

      e72d0d7f3a679701fed55a44f0c304a6dc9077567fffa2d6b6d8e02976535615

    • SHA512

      5650d864b8b99e5f8bdbc09cefaf2935cb15a9fa8a724e284aaa9af9639344d564620c72dd0207268501ebfe50210039dbbacc9ecd609ed8e64172d9b959df5f

    Score
    1/10
    behavioral23behavioral24

    • Target

      DiagReport.ps1

    • Size

      8KB

    • MD5

      7457f5e88035d91752f988df57aa0689

    • SHA1

      8cbd43f00fdc2ae2b0ac7429454eb7708031ee70

    • SHA256

      4180f15d32e84d1f3ed1c256bdc86f73d96e6615b3a10bf67bfc50c30a9912ed

    • SHA512

      2ccfe0eb0724461fc123f9693724386426497ed7236a5180475223528610216dab9f5b4d61a53dc6882322aec3414b7b9a1c39d651a6a289ba40e29d51575916

    • SSDEEP

      96:4g+14dBdsaHQCMMavbtBG7IYMGOUU+Sz1ROVP7BNE9dn:4x4dBdsaHQZMay6W1X3Kh

    Score
    1/10
    behavioral25behavioral26

    • Target

      NPFInstall.exe

    • Size

      230KB

    • MD5

      dfadc2b2194129c68a987b76d3fb227b

    • SHA1

      87dcf0effa158f6881132d65cc6174ad5b19fd70

    • SHA256

      d795d8b9a6c819c90bdd818d1d8f2f4860c3bed256329dad067eae84ba0d96e1

    • SHA512

      394dcdd23c0dc392e9e7eafa871a88232c379737cdc2f3c031c7a2b95084d2c0715b6f47ee51a6c7c5aa52b5821a427bb737dab5eb0282f5139d14a1cd320219

    • SSDEEP

      3072:rHrzqTbRi1VV52BS4FyumD44Qhd0OiN4+lxfEomrL/eMGBMUMS0ZUY57UH:DSdMl2BxLfGb4ufVMnn/Za

    Score
    4/10
    behavioral27behavioral28

    • Target

      NPFInstall2.exe

    • Size

      230KB

    • MD5

      dfadc2b2194129c68a987b76d3fb227b

    • SHA1

      87dcf0effa158f6881132d65cc6174ad5b19fd70

    • SHA256

      d795d8b9a6c819c90bdd818d1d8f2f4860c3bed256329dad067eae84ba0d96e1

    • SHA512

      394dcdd23c0dc392e9e7eafa871a88232c379737cdc2f3c031c7a2b95084d2c0715b6f47ee51a6c7c5aa52b5821a427bb737dab5eb0282f5139d14a1cd320219

    • SSDEEP

      3072:rHrzqTbRi1VV52BS4FyumD44Qhd0OiN4+lxfEomrL/eMGBMUMS0ZUY57UH:DSdMl2BxLfGb4ufVMnn/Za

    Score
    4/10
    behavioral29behavioral30

    • Target

      nmap-7.60/nping.exe

    • Size

      324KB

    • MD5

      1f00d7b3d450869449281fad3e64eaeb

    • SHA1

      371570db222a26c402a594eec353c2a666563b4b

    • SHA256

      5856947a5ee92d70b60a2ffbf924c9a0173e39a1f6ee60979d6337a1dce68ac5

    • SHA512

      cfa564351ec5f01cf9d4827543a52f6ad5e172ca16c34afbbe4573957b3d7099437f48993e9f12982a432998218024afefdbd387675dc062925b3189a502843b

    • SSDEEP

      6144:5GKUKKTRKXuNupG5+//OumBeEUPdJF7m2ufXUb4/B6o5hbuZvvlEZ2:IKXA1d5smkpJIHfXFj5h8EQ

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks