Overview

overview

10

Static

static

3

5aa6faa9fa...18.exe

windows7-x64

10

5aa6faa9fa...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5aa6faa9faa35e97f9527e74b225a3e8_JaffaCakes118

  • Size

    720KB

  • Sample

    240519-wcpzeaaa97

  • MD5

    5aa6faa9faa35e97f9527e74b225a3e8

  • SHA1

    470b643745f6bf44cb09e8162d7120adcfd71e60

  • SHA256

    7b06aa6735ae3956748e9fee4994b459dea5bcd64abbd85c15ef8a9f874c6cea

  • SHA512

    6b29db274b46b5675d3c508b4e605e3f6a1c5e15bb7b07ed92020af2e90551b46a6f06284d232c5756c77b66213c99f3cc0d70b0d31c6eacf1910994221c521b

  • SSDEEP

    12288:gwih9pFaczF1wAgyNeemCGnknz+A/1Hrj5/db2zHQdj+U:2pFdz3BeemC3vXFb27Qdj

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      5aa6faa9faa35e97f9527e74b225a3e8_JaffaCakes118

    • Size

      720KB

    • MD5

      5aa6faa9faa35e97f9527e74b225a3e8

    • SHA1

      470b643745f6bf44cb09e8162d7120adcfd71e60

    • SHA256

      7b06aa6735ae3956748e9fee4994b459dea5bcd64abbd85c15ef8a9f874c6cea

    • SHA512

      6b29db274b46b5675d3c508b4e605e3f6a1c5e15bb7b07ed92020af2e90551b46a6f06284d232c5756c77b66213c99f3cc0d70b0d31c6eacf1910994221c521b

    • SSDEEP

      12288:gwih9pFaczF1wAgyNeemCGnknz+A/1Hrj5/db2zHQdj+U:2pFdz3BeemC3vXFb27Qdj

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks