Behavioral task
behavioral1
Sample
كركل كروم.exe
Resource
win7-20240508-en
General
-
Target
66d6bab5c56a9cf6167077a97334a3c8_JaffaCakes118
-
Size
533KB
-
MD5
66d6bab5c56a9cf6167077a97334a3c8
-
SHA1
f0e954d37d356b8240d9e5278cbb72591370b434
-
SHA256
255f5a92f6d426254f7fdf56f9940855914b50516e94b1e6cab2af9a5a7d625e
-
SHA512
3894a2414c3fe810bf64affd4ddb424389c41d619cb209fbf343f20d5d79776c47274322458e3c4ad57f56dd40c9e5dba439d6ae8ee3a966cdb601a5221c0cfc
-
SSDEEP
12288:8lzr1LIHeIeTFZEWkQxxKR8ndHPU0ASyNItfb0KZIO:8trD1TKQxPP1AKtj0HO
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/كركل كروم.exe family_neshta -
Detect XtremeRAT payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/كركل كروم.exe family_xtremerat -
Neshta family
-
Xtremerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/كركل كروم.exe
Files
-
66d6bab5c56a9cf6167077a97334a3c8_JaffaCakes118.rar
-
كركل كروم.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ