Overview

overview

10

Static

static

7

29d9ea4249...18.exe

windows7-x64

10

29d9ea4249...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29d9ea42495e90a9e5c69945f7bf6d6c_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240707-j741lazeph

  • MD5

    29d9ea42495e90a9e5c69945f7bf6d6c

  • SHA1

    c24f0661f494325445af1555cd3f01b358455ec9

  • SHA256

    3e22037f99379208fbf50995fcb877642257e8c19355fdd1890df404aa432715

  • SHA512

    9c4116f2da26f7bbbc74cc1a18b3811f9d4ffc6e2962fa1a1707011896a98d05acb67287d145145090c222da9bf3e977c1420afafb66d5ff35b4e39614273212

  • SSDEEP

    49152:xFwCPBfDI71stuiJofmGrg8S2HmRCl6QeVhIgEGP6Ik:xC+tI71nq/Gr/HmRAfgEG4

Score
10/10
sectopratevasionratthemidatrojan

Malware Config

Targets

    • Target

      29d9ea42495e90a9e5c69945f7bf6d6c_JaffaCakes118

    • Size

      2.9MB

    • MD5

      29d9ea42495e90a9e5c69945f7bf6d6c

    • SHA1

      c24f0661f494325445af1555cd3f01b358455ec9

    • SHA256

      3e22037f99379208fbf50995fcb877642257e8c19355fdd1890df404aa432715

    • SHA512

      9c4116f2da26f7bbbc74cc1a18b3811f9d4ffc6e2962fa1a1707011896a98d05acb67287d145145090c222da9bf3e977c1420afafb66d5ff35b4e39614273212

    • SSDEEP

      49152:xFwCPBfDI71stuiJofmGrg8S2HmRCl6QeVhIgEGP6Ik:xC+tI71nq/Gr/HmRAfgEG4

    Score
    10/10
    sectopratevasionratthemidatrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks