General

  • Target

    84d5bcf5145b4e674077d7a57ee278b6_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240530-vjw6maed7t

  • MD5

    84d5bcf5145b4e674077d7a57ee278b6

  • SHA1

    5246e20117951274aa94b4d5a9627b9d1fb4d720

  • SHA256

    3187ec733179fb0ea2221d39e3efb620c4fe9fa8b3790b0c91792dc073f4a08d

  • SHA512

    115da73519b9baf29ef5c3e05600377bcb770d34b47d27d4cd5dc0c5e202c4a149b0becaacceb95a93b4144fb168ec5a2671644ebbf8ec211d11f51fcbaa186c

  • SSDEEP

    49152:hV3ah3eaWTv/SM003FoiBALUHliSIKkYPg5YHGNN:hV3axTW7KM00FoiWUHgPbVLN

Malware Config

Targets

    • Target

      84d5bcf5145b4e674077d7a57ee278b6_JaffaCakes118

    • Size

      1.9MB

    • MD5

      84d5bcf5145b4e674077d7a57ee278b6

    • SHA1

      5246e20117951274aa94b4d5a9627b9d1fb4d720

    • SHA256

      3187ec733179fb0ea2221d39e3efb620c4fe9fa8b3790b0c91792dc073f4a08d

    • SHA512

      115da73519b9baf29ef5c3e05600377bcb770d34b47d27d4cd5dc0c5e202c4a149b0becaacceb95a93b4144fb168ec5a2671644ebbf8ec211d11f51fcbaa186c

    • SSDEEP

      49152:hV3ah3eaWTv/SM003FoiBALUHliSIKkYPg5YHGNN:hV3axTW7KM00FoiWUHgPbVLN

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks