General
-
Target
3cae98f72f7c54eb868a5e000fdd58ff_JaffaCakes118
-
Size
3.4MB
-
Sample
240712-kkjltawcqn
-
MD5
3cae98f72f7c54eb868a5e000fdd58ff
-
SHA1
8c2f20931d81d74d89c440f1b4716678bf9159e8
-
SHA256
77955a774395ca75cf1ace7c40fe3f22e3631311edae2ea4770a7c7d72703a2e
-
SHA512
6ec375487d2d800e00a3965ab2033ddb8e4bd0d80f78571a57a9ac1c0d3b6e5f1833448274f2259f0c7c64592a765925c7e4198cf21b1787ae5ccbab7ea9b60e
-
SSDEEP
49152:4eDcLen7jmYy28FPMXku9aok36cdUIMbrjQFoTeGTrEhPfQAqQxjHNE:GLe7a2IQap5UegHHsQFQtN
Behavioral task
behavioral1
Sample
3cae98f72f7c54eb868a5e000fdd58ff_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Targets
-
-
Target
3cae98f72f7c54eb868a5e000fdd58ff_JaffaCakes118
-
Size
3.4MB
-
MD5
3cae98f72f7c54eb868a5e000fdd58ff
-
SHA1
8c2f20931d81d74d89c440f1b4716678bf9159e8
-
SHA256
77955a774395ca75cf1ace7c40fe3f22e3631311edae2ea4770a7c7d72703a2e
-
SHA512
6ec375487d2d800e00a3965ab2033ddb8e4bd0d80f78571a57a9ac1c0d3b6e5f1833448274f2259f0c7c64592a765925c7e4198cf21b1787ae5ccbab7ea9b60e
-
SSDEEP
49152:4eDcLen7jmYy28FPMXku9aok36cdUIMbrjQFoTeGTrEhPfQAqQxjHNE:GLe7a2IQap5UegHHsQFQtN
-
SectopRAT payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-