Overview

overview

7

Static

static

7

Bunifu_UI_v1.5.3.dll

windows7-x64

1

Bunifu_UI_v1.5.3.dll

windows10-2004-x64

1

Indicium-Supra.dll

windows7-x64

1

Indicium-Supra.dll

windows10-2004-x64

1

ScintillaNET.dll

windows7-x64

1

ScintillaNET.dll

windows10-2004-x64

1

krnl.dll

windows7-x64

7

krnl.dll

windows10-2004-x64

7

krnl.exe

windows7-x64

7

krnl.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b06474677584f8dfaf993448d642c6c7_JaffaCakes118

  • Size

    3.5MB

  • Sample

    240615-18sgma1blr

  • MD5

    b06474677584f8dfaf993448d642c6c7

  • SHA1

    e9ca6f0c34ebb558743f1569ceb3e0b269600ac6

  • SHA256

    699ebcd7261ee4d77703e40c5516f33e1a1df5d55b211c864abb86b74b52ad95

  • SHA512

    9c1c350b354b1a65c364bd4c3b6ab2bab0bb20510597f60e1151207b7f832d1b54edec9f4f3f49b7e0ba2f2f185dfb902d8c0bd3bb547264715912eaad822092

  • SSDEEP

    98304:jPxyzGhzoNeaEDhL0BvC2jrqR/q0YySU38c3/03FIgcCfxC:jBhUB+90Bqerqq9FUM8mWZCZC

Score
7/10
vmprotect

Malware Config

Targets

    • Target

      Bunifu_UI_v1.5.3.dll

    • Size

      236KB

    • MD5

      2ecb51ab00c5f340380ecf849291dbcf

    • SHA1

      1a4dffbce2a4ce65495ed79eab42a4da3b660931

    • SHA256

      f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

    • SHA512

      e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

    • SSDEEP

      6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG

    Score
    1/10
    behavioral1behavioral2

    • Target

      Indicium-Supra.dll

    • Size

      783KB

    • MD5

      a2b0d88eb999664799e5263c055b90da

    • SHA1

      aaa52f473d0c519fd0154cc096b7ee177adf781c

    • SHA256

      cb9f94ac4f4e2bb1576b7178fdd68035067f5836996cb2adef2cab4e7f192cbc

    • SHA512

      442d3cebfea6be743d19a061e104e307303c804d23b958c28a8fbcd3f46c64c474f04fc1f87f492cb1078d838a9ef5be80d58ed5ef827646a5752d10f31d8e1e

    • SSDEEP

      24576:foLHXgkLLPF1NH18kFpZUQuosgP+1QH6Uy:qXl8kFNuosgPh6Uy

    Score
    1/10
    behavioral3behavioral4

    • Target

      ScintillaNET.dll

    • Size

      1.3MB

    • MD5

      9166536c31f4e725e6befe85e2889a4b

    • SHA1

      f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

    • SHA256

      ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

    • SHA512

      113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

    • SSDEEP

      24576:IJSShz305vgNF7/cOCPHPSVs4Eq+QTNX+cfQdS+2MMPishd/Ws5:ti0aNvoHqs4L95X+cfx/HGC

    Score
    1/10
    behavioral5behavioral6

    • Target

      krnl.dll

    • Size

      1.1MB

    • MD5

      94b8c1ee2252d07be68a8a154f1be59b

    • SHA1

      c8f528fd409b54006c6ecd4bd0be0fe3209faa54

    • SHA256

      f002b087f08dac8873e91f04cd23f675c5a8666e70a6032afe7e582b3ac1b551

    • SHA512

      4f265e0f3f883e406299f994ed5f08bfb93ad154ae645791cb5668aac211f922660decf1836904928815a859e215e1c312ecda381fe986888e31fe1182ad75b9

    • SSDEEP

      24576:XV3M3R/Wa288SakvW8P3GY6j5O5YKS+5pV3Munt:l3MVWa28lvuYsO5YKX5H3MSt

    Score
    7/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral7behavioral8

    • Target

      krnl.exe

    • Size

      2.2MB

    • MD5

      3eb033ab0d3a63fd07abcf676c9ae3fb

    • SHA1

      d42329938146081e43bf4105f30475c888df744f

    • SHA256

      7d8f888fa63661fad1bbc57f7e88b4f7c50e65b70502d56d36c4b5d2c9effc63

    • SHA512

      2b0e23893a88de7a1c35d43ee0ab264cad351d1b12fcff56beae7efd0636332ea7fa891e1965ed191bcd32bb614ec9742658812ea0d53ee2df4591236941d255

    • SSDEEP

      49152:Q3nWGu3gXNoFbvNOL1b/HmDeH31vAN3/bk3gk:QXWGzovOl/HmiH31vAN0

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Tasks