129308c55bc585412536000136bbcd0936df8e3ade81c3289c79ccb6c662ec4b

Sharing

Copy URL Twitter E-mail

General

Target
b87e3e19687ed65a72db613627b87336_JaffaCakes118
Size 17.1MB
Sample240617-n5r1gatepr
SHA256 129308c55bc585412536000136bbcd0936df8e3ade81c3289c79ccb6c662ec4b
MD5 b87e3e19687ed65a72db613627b87336
SHA1 6dae35268f86e10380aca97113641d7326533219
SHA512 8ad382b7822a1013d7475bcab4b0816b9e94bc75a4a9e3b94b701a0d805ed1fe6f44ad25715c03591bd3ccdb85d463e267a0e5b1c0dacc15f368b3ff562ebc5a
SSDEEP 393216:yOj2JHJrEqB6PgVqB6mFjN7angwjFGWA2pd8qQOmdv:OprbwR5FjN7anNjFGWA76mx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  ford/elmconfig/ELMConfig+DLL/DLL/MSCOMCTL.OCX
- Size 1.0MB
- SHA256 18a83d7a420a17fcb6f56eb3ba5362c975d32e5ded7553c6fd407f07bdb7b006
- MD5 f7bbb7d79adb9e3adc13f3b3c33d3d4d
- SHA1 cacb4b31d22419e6a9ddbffcf61ae42da0d5fb8a
- SHA512 4870ddbdf283d7f7f64d3f4bf556600a78804f6a94fc2ca7eb778e85d70b6d2d017aa35cbddf773b6a1b6d9a2813cd67fe54ede7859050a254a3e3c05616ae0e
- SSDEEP 24576:mnt4M/pL1wAEIqSBanK6CC33VTj+1R8xRFLqqmbD1kWIAqPA:mPL15EIqS1e6q3FmKbt4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  ford/elmconfig/ELMConfig+DLL/DLL/MSCOMM32.OCX
- Size 101KB
- SHA256 51a1d6812e445c26c71465e2709e6d1ad587f8513002d662cd160f424f48b37c
- MD5 2c6119da3993f410e74b15112f840cb0
- SHA1 9d7aaffc0bcf955cc75d4ecc228b1ceda8a1856c
- SHA512 053ece4eb2ddba51c0d683a7afd439ed88605ab83619de738f7ad2495bfe9e9f16fc3b829c7fc9c779b50f039b9fad66d16aed520a5adfd1522a711073f78208
- SSDEEP 3072:zsQgdI5Hh8p28XMehRYSdB/TYDY44UGyGfDnfra:zdgdI598jhRJpYDY4fefna
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  ford/elmconfig/ELMConfig+DLL/DLL/comdlg32.ocx
- Size 137KB
- SHA256 64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195
- MD5 b73809a916e6d7c1ae56f182a2e8f7e2
- SHA1 34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5
- SHA512 26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333
- SSDEEP 3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  ford/elmconfig/ELMConfig+DLL/DLL/msvbvm60.dll
- Size 1.3MB
- SHA256 2d8c626bef52e64ba0e5a6301c82c748dc65bdef7bf8e73be2f50448e14ed2ae
- MD5 96e7acd0b32be90f4f8b3237adda1efa
- SHA1 3a3a3ccc42714dc4dd22c6b106caa24f7f81e34d
- SHA512 1f055a50152aa40a07004f95c8793f6e3e0b0c6db66ddc3b01e2b86267fdc4ef9884619e82b5ca4e0102b2461697d3177361a6812ca721c26d034e92a2132fec
- SSDEEP 24576:gXEt6JlHZQrHWNmYhYv92+k4QBZb72JQy3oZZtmS4pXi0qRCtDg+:gU90Gv92+k4QBB2JQy3oVmS45iLC2+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  ford/elmconfig/ELMConfig+DLL/ELMConfig/ELMConfig.exe
- Size 244KB
- SHA256 6f4ce8a08f188f6ed736950a76b5c71575fd9a87b2de86b46178ad4508bfb776
- MD5 6ffe06ea2ff458efa3fdd6ecd2c0547e
- SHA1 be9f7b73816dc5d2300b1b62ebae5fbd969185de
- SHA512 386bcab8b3016ea77fbf05fc32492be371d3c7cf81e56cff785274ce61b3a204fc8d2f38f5e3ea941ef636ddf04574fdee350ef0f2705cf86c5bc8ed014197a5
- SSDEEP 3072:m5a2wCHi7yBRt4Yp1fOTeYlZynZTusjO7nIWBMfb9hftfZ+sGPjpMFMuBAMLrL5X:MHn6g1fOTeYlZYZTxmIdLfxUrtPuXmI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  ford/elmconfig/ELMConfig_v0.1.1.6/ELMConfig.exe
- Size 104KB
- SHA256 e24b02b94d44a4c1198c9d847621bfc3b6dc34148a8ad29d6fec410ac29caee6
- MD5 3969de9f976ff13cea615fba93400bf7
- SHA1 38dfa1de5b832300385596083939f7f707704506
- SHA512 00371ef023824a2f54572954ac479f697cebf0418bf4aed2252c4e7aab267179a018aa15f2528eff460144a687aad1fc41a5bedb5952df6cff2851ce0e803ab6
- SSDEEP 3072:xOQObtcwWjtYbezRnMPSQwFX3kFkto9Vk:9eIYKNpFo9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  ford/elmconfig/ELMConfig_v0.1.1.8b/ELMConfig.exe
- Size 160KB
- SHA256 8678a75d05076b6c8903e37cc6f7d2cb30130d4ff99a52bcc687a1204acd8cac
- MD5 b2c7b0354b0894707a3ecb0ebdd7b78b
- SHA1 9e20c89b9765d80545244cdd4bf3b302bc3c4113
- SHA512 474819e896e3a3b9b1850d5b066cf8e31f69a31754b207ba7b094da21088cebe6d26309ec1698b27ea0fb255733ccae05e35ee8dcbda3462ab203ccbf201ad22
- SSDEEP 3072:mHzgLA4mxayRFcppcqawEDewaPMCyfXDkgL68igb38sw19bkFPnQw7m:mTgLA4wk7yw4gU9Dkg+8i838LXkxQw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  ford/elmconfig/ELMConfig_v0.1.2.1b/ELMConfig.exe
- Size 208KB
- SHA256 7f5b1ecfc7ed4313b95b764f06a3e1bdffc592dc6b36c167b4afb30587abd6d6
- MD5 fc3fcb38c893318be3aa9a72a94f480e
- SHA1 83342e62b25e8194a5031d5f2f06f782d548a9a3
- SHA512 e7fd2a24e49d2299c2991b349f0ca4da969e1e3877842aecdfa62dae48bb18cf77867789f9f1a00f236cdd5893f1abd371916b39371a6705ee6ae0630247f03f
- SSDEEP 3072:yISRUFDpTpkgRsgIvPsokCZhrV3lKu8OpEHGKRQBlizEvwhpnwttC4ZbPA+GYp84:I6DPYvUokyhEGfIow/wPRZbNp81l6
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  ford/elmconfig/ELMConfig_v0.2.2b/ELMConfig.exe
- Size 268KB
- SHA256 5606eda90132f4d7c2a7dc69fdbc70a6847b2053723a73ac842e0fde5ce24963
- MD5 55156037739e419f42ea14b9876bccea
- SHA1 c2288c4610fab262c44f80a08ef239012ddd9b8a
- SHA512 357e58ef10b06872068f945bc2fb8b98ee8ae99be61b47b4ab43373b4815ba199bbc282f049b34a7867d08e72aadfe5e2a7523cf7bb7ed8b650074d4d1274eb6
- SSDEEP 6144:XyyAcYH+6m82cAfNBiIP96e6dFQOYiR46Vkr0VVzEUKY:XyXXH2HltQQOYiRbVRVVzZK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  ford/elmconfig/ELMConfig_v0.2.4/ELMConfig.exe
- Size 272KB
- SHA256 122bc73f506bfb8f79f9f45909521cb447d31b0f366550416a9e2ce8e9313391
- MD5 5521e906dd2284c95b533adccc0a6f81
- SHA1 5841e036d10bb4b440ae3274ad76f791e9c7a4f5
- SHA512 541b6d92a8fa0b9f60f5edead18be35b7bc05699c841eb9eba2063d97d28cb9150013efd0d69487a41aca150384b94937a7d93d442280cece324dd3aed335acb
- SSDEEP 6144:OGsbYfUfJdiSeGHTIIbhqr718wdgQUnYeIBgLjCk:4BRoxawr718ugQMOBg/p
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  ford/elmconfig/ELMConfig_v0.2.9/ELMConfig.exe
- Size 412KB
- SHA256 33f738544d930af4f766ab68bf4303d8140d414e9045cd85df61cedce0af8854
- MD5 3ad782bea7d4a0de754c9bc9a4e3dc40
- SHA1 0273dfbcf4dd5f62c10adf02de0e3e8919d4e7ab
- SHA512 6db6246b4e3bfbd4733f37757f4bbd55c9728ed33f3a8322d6cc70dc3f0566767fae0ac4cb844242566d06eb434b2a09bef9ec2d273ad7552cf2e4ea8f46f306
- SSDEEP 6144:ifDxdkhlkce2g5cD0fwWMfeHjGpj5o1yba6cu6/gplBOjxGAN5PP:vhlkcPucDOw752ybZcuxlgPl
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  ford/forscan/FORScan.exe
- Size 874KB
- SHA256 c9c66f10910456e07e8e4d4f977ac3612f4b019da5308560b74df34bb5b8315f
- MD5 cf5debf90bfd7a7e6e7e001cdb918b15
- SHA1 e6867b1a7268de113ea0658cce62f755394f659c
- SHA512 e1d6b58d107ed2b42331427c3c91574aae41b266bada36bea463204f58ce6af579eb921b0bba6a2c4f5543765f77c9ce75edd42c10b52bca4eb2c843adf16e5a
- SSDEEP 24576:z1N7ZKT7HmA+J/baHpZqWjeAfW4Dsgyv5:RNU74+zFjeZ48v5
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral23 behavioral24
- Target
  ford/forscan/unins000.exe
- Size 698KB
- SHA256 ad92100f17ac6bb218502cea089f90473e09ae5a114049d5837c1955bcdf7dd0
- MD5 111c90099126a942d97c2a6dfefe5ccf
- SHA1 c14359bfe4471562ff5551bfcf17a2063455454e
- SHA512 1e30783870e0678016ffcc9656db3830a54d8ba7d0c196e9508c71f92accb5b215b13134639c3df193816cdb3d1e645eef5f6f3fbfd85e0ba88142a876b4016a
- SSDEEP 12288:QRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExycg:6ObekYkfohrP337uzHnA6cHswHE/6gUw
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral25 behavioral26

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Writes to the Master Boot Record (MBR)

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26