Behavioral task
behavioral1
Sample
tunneld2/Master.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
tunneld2/Master.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
tunneld2/Slave.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
tunneld2/Slave.exe
Resource
win10v2004-20240709-en
General
-
Target
311a4e2bfbf81f066cff42f99dd04907_JaffaCakes118
-
Size
318KB
-
MD5
311a4e2bfbf81f066cff42f99dd04907
-
SHA1
d6007b4c9f00d1607b9555ad37a497094d20b36a
-
SHA256
ca62b5a330bfc3ffb0b38396044e552b0812761e4c86636ef81d6ce8443e9aad
-
SHA512
90836da8808e37ffdd1e5a853d0b3ecb5d532e83f10a95b677d74b9cc15dd43ffb62ae919218e668231ec688289692f595556b84c403c0db7fa3dcf3bfcd1372
-
SSDEEP
6144:x7g5wEp6R6Dtidn5VmvIoTlSJpHtM8Tyl3WH+HuBRPiQK0tiDDnTUhfvh:5g5w8ltm5VmvHTULTTUmH+HMZiQfvh
Malware Config
Signatures
-
resource yara_rule static1/unpack001/tunneld2/Master.exe upx static1/unpack001/tunneld2/Slave.exe upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/tunneld2/Master.exe unpack001/tunneld2/Slave.exe unpack003/out.upx
Files
-
311a4e2bfbf81f066cff42f99dd04907_JaffaCakes118.zip
-
tunneld2/Master.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 800KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 301KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
tunneld2/ReadMe.txt
-
tunneld2/Slave.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 66KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 12B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
tunneld2/loginclub Readme File.txt