Overview

overview

8

Static

static

3

1f6ffbf885...18.exe

windows7-x64

8

1f6ffbf885...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    1f6ffbf88537755b91d44ef7f2adec54_JaffaCakes118
  • Size 15.9MB
  • Sample240507-e1w9yshf3y
  • SHA256 cc68c64d94ebdf8b1595358fafd3e08dfe0d7c8e545eb97dd7be4c8bdc82fc7b
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
agilenetevasionexecutionvmprotect

Malware Config

Targets

    • Target
      1f6ffbf88537755b91d44ef7f2adec54_JaffaCakes118
    • Size 15.9MB
    • SHA256 cc68c64d94ebdf8b1595358fafd3e08dfe0d7c8e545eb97dd7be4c8bdc82fc7b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    agilenetevasionexecutionvmprotect

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks