Overview

overview

10

Static

static

3

IMG_201701...40.exe

windows7-x64

10

IMG_201701...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85b39b9093615c5c78629c61e761544b_JaffaCakes118

  • Size

    4.3MB

  • Sample

    240531-clx7lace83

  • MD5

    85b39b9093615c5c78629c61e761544b

  • SHA1

    b474b29882796848c1b5ae288b0f2ad5f2478f6b

  • SHA256

    fcdefac268bff13037fb93ccfa63c60b8c51eb57803bd33e03695113adcafbc4

  • SHA512

    80294fa3e819ed1cb94397b2a60f053c828ce39decba4c3d8f7b05f17876a3bfa6d152ed0e08416537ede809d8a465fcbdd0257c9e63f73821d50bbf0fc383aa

  • SSDEEP

    98304:HgxlcnuWHvDkgOrN2ZdCy5D22VHjEM361E3eWJVeGS+0EY:QcnuWHby8ZdC422JELy3bcGS+c

Score
10/10
banloaddownloaderdropperevasiontrojan

Malware Config

Targets

    • Target

      IMG_20170109_111125_540.exe

    • Size

      6.1MB

    • MD5

      2892289af9751f47f719cb6a67051127

    • SHA1

      c891dbc7be62fb454c34287a95fa9dff3fde8253

    • SHA256

      a8ded67687cdd8dc39e93b7c26624c7d06d8f5aae9c90028fad5f7fc6437f1e3

    • SHA512

      2c62420f3c8bf4a0d3c760d802fe7e5c8b324aa66d63e6b2c922c4f4dc3f7ddd042252e5432631b9bbf9bc42ce0c07aa3bf442abdcf8af47394513de608ef4bd

    • SSDEEP

      98304:7cgTt/wKjmf6ysiHSzRmz1bOL+PnXcwMoZ/qTJSyvxEKVbv6Mz+JMfwkjbUGMcc4:7cgCYmfdPnswjSTJS2EK56dyfxoGMcf

    Score
    10/10
    banloaddownloaderdropperevasiontrojan

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks