General

  • Target

    91d42bf59806a9092dd32db035a1e769_JaffaCakes118

  • Size

    2.0MB

  • Sample

    240603-pywkraeh21

  • MD5

    91d42bf59806a9092dd32db035a1e769

  • SHA1

    19b207cbe2058fd6eecfcca77057fa61fce8b291

  • SHA256

    978a987773971765146f833f0bcdd1949515e3265bcb7008afa8a61423eee11d

  • SHA512

    a1f045381804e4c1a2857a0e970dc733fec723319929d68ffe35e188606eb5c762aa0ccf9ef931cbf694ce78a6f718fb88e307cf6ff0b37cf53d54066cf4f44e

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM1:NABt

Malware Config

Targets

    • Target

      91d42bf59806a9092dd32db035a1e769_JaffaCakes118

    • Size

      2.0MB

    • MD5

      91d42bf59806a9092dd32db035a1e769

    • SHA1

      19b207cbe2058fd6eecfcca77057fa61fce8b291

    • SHA256

      978a987773971765146f833f0bcdd1949515e3265bcb7008afa8a61423eee11d

    • SHA512

      a1f045381804e4c1a2857a0e970dc733fec723319929d68ffe35e188606eb5c762aa0ccf9ef931cbf694ce78a6f718fb88e307cf6ff0b37cf53d54066cf4f44e

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM1:NABt

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks