Overview

overview

7

Static

static

7

038ff6f32f...18.exe

windows7-x64

7

038ff6f32f...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    038ff6f32f933e50b00c7b2d9750ed9b_JaffaCakes118

  • Size

    858KB

  • Sample

    240427-zaemfagc2x

  • MD5

    038ff6f32f933e50b00c7b2d9750ed9b

  • SHA1

    2c4dd7d486b2b13069d640f39c5b8a5ce3b81bb9

  • SHA256

    038edf8aea816bc0e40d3d415bef7ebbbe5135540395ef60ff49d18913aad70c

  • SHA512

    5feada9087ebc19a1caae64076e75185855ea3364134338c1db913a77e47d2a83842f060fbd358b1ede32e89863fd623d6cc24f56314d905c4023078f89d8746

  • SSDEEP

    24576:eKBOf71t66Ai+nwaFNVlbYaiM06ba0hkewwTe:CT1t0w41D7+0hke7Te

Score
7/10
evasionthemida

Malware Config

Targets

    • Target

      038ff6f32f933e50b00c7b2d9750ed9b_JaffaCakes118

    • Size

      858KB

    • MD5

      038ff6f32f933e50b00c7b2d9750ed9b

    • SHA1

      2c4dd7d486b2b13069d640f39c5b8a5ce3b81bb9

    • SHA256

      038edf8aea816bc0e40d3d415bef7ebbbe5135540395ef60ff49d18913aad70c

    • SHA512

      5feada9087ebc19a1caae64076e75185855ea3364134338c1db913a77e47d2a83842f060fbd358b1ede32e89863fd623d6cc24f56314d905c4023078f89d8746

    • SSDEEP

      24576:eKBOf71t66Ai+nwaFNVlbYaiM06ba0hkewwTe:CT1t0w41D7+0hke7Te

    Score
    7/10
    evasionthemida

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks