General

  • Target

    27c3075ff1ab0c13ced9c9977525ee6f_JaffaCakes118

  • Size

    14.6MB

  • Sample

    240509-cgh7wafa77

  • MD5

    27c3075ff1ab0c13ced9c9977525ee6f

  • SHA1

    6476a04b713b87f956b49ef15398d08f840fde24

  • SHA256

    1a9e623481244618427c69ab76f80e6c38e69b4ac3208fc5017d6675389928bb

  • SHA512

    8da343d74303ca92350fb7f685c66557421b26f759eb8859daf647abee0ce6f410f84be33411100454bde96ae6e46c550021a92ececf092afb95bf1ddbd3bcf8

  • SSDEEP

    196608:Ta9+6Y7SOEibgRTiGBfWtbsvXGBfWJGBfWDGBfWJGBfWmta9+6Y7SOEibgRTiGBZ:TFgRHWCEWeWgWeWKFgRHWCEWeWgWeW7

Malware Config

Targets

    • Target

      27c3075ff1ab0c13ced9c9977525ee6f_JaffaCakes118

    • Size

      14.6MB

    • MD5

      27c3075ff1ab0c13ced9c9977525ee6f

    • SHA1

      6476a04b713b87f956b49ef15398d08f840fde24

    • SHA256

      1a9e623481244618427c69ab76f80e6c38e69b4ac3208fc5017d6675389928bb

    • SHA512

      8da343d74303ca92350fb7f685c66557421b26f759eb8859daf647abee0ce6f410f84be33411100454bde96ae6e46c550021a92ececf092afb95bf1ddbd3bcf8

    • SSDEEP

      196608:Ta9+6Y7SOEibgRTiGBfWtbsvXGBfWJGBfWDGBfWJGBfWmta9+6Y7SOEibgRTiGBZ:TFgRHWCEWeWgWeWKFgRHWCEWeWgWeW7

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • UAC bypass

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks