Overview

overview

7

Static

static

3

dbfman131.exe

windows7-x64

7

dbfman131.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

DBFManager.exe

windows7-x64

6

DBFManager.exe

windows10-2004-x64

3

Homepage.url

windows7-x64

6

Homepage.url

windows10-2004-x64

3

Uninst.exe

windows7-x64

7

Uninst.exe

windows10-2004-x64

7

dbfmanager.chm

windows7-x64

1

dbfmanager.chm

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65e9c833c40f4b14f28ec133639875a3_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240723-dqb1lavdml

  • MD5

    65e9c833c40f4b14f28ec133639875a3

  • SHA1

    65c6fde0f0562e479bd257f6ef352cf76bfd1e40

  • SHA256

    3a3ccd72e07241dc8037fa38626058f25767f9f7a78ee68a372632841004ee79

  • SHA512

    9f3e02396b4bab24e9da6debe5526f19cf349467a6669dbe0c223b1ef12e1fa8fbf0fba3c183df8d09abaa86aaefb393a3f65f1b6bd8d3938be2a380e60b6c70

  • SSDEEP

    49152:P8fkYdhBkjyliOMg9Frev6QHopzwGfR3l6h9C/:PXYrSWIEFE6dzlftl6y/

Score
7/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      dbfman131.exe

    • Size

      1.5MB

    • MD5

      62129b51206ff5f5fec86c79e88dce7d

    • SHA1

      b739264cdce595709348282c5f6802ce0b6b10a6

    • SHA256

      72972e69c11a806df73ff906b73dc9590efd45b2276effee4f62d3a29d8437ef

    • SHA512

      e17b5823e4bc6b150580a6916565d5f72500f4000e42db28f0e90cd4b1047799a75a5a15949b48b254dac34f337126dbe913b795e2c13ca048c3f6dae7f33d0c

    • SSDEEP

      49152:4nH5Y5MgqcSaV3DWxlxPEq83Oq+Qt1D8A5:IH5Y+gb1V3DaxPE/3OqniA5

    Score
    7/10

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      12KB

    • MD5

      1d5c649dde35003a618b9679d5d71b92

    • SHA1

      0409bbab3ab34f8c01289cdd847b4d1a32d05b18

    • SHA256

      0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

    • SHA512

      b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

    • SSDEEP

      384:pKlm7i+c3QW6ckPhyDEaLnA2bbBBIXwZ:8qi8BcyhEhLBbbTI

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      4eff5fafd746f5decb93a44e3a3d570c

    • SHA1

      a11aa7681b7e2df1c7f7492a127d332d1495ea8a

    • SHA256

      cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

    • SHA512

      cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

    • SSDEEP

      192:0OycJo/rJVCmIDNLU0dq5RD00lspbub76yL:6/QQ0d0RD0USq/6y

    Score
    3/10
    behavioral5behavioral6

    • Target

      DBFManager.exe

    • Size

      1.4MB

    • MD5

      1c049946735089036f664e195c384bdc

    • SHA1

      51be44344e0649281585b8f7182a2bda5cedcba4

    • SHA256

      f58001de63539de3ccee1f17ae5960c2c3eb382f590ef264cca7885271a96aef

    • SHA512

      1c0f27408268ed5750fa93d7a80c48af64acd4139f78880ebde839fe38ab47578475070d3956921abdc9ed4deda2af8c3ce7e8ca7575689e017791465bc324f5

    • SSDEEP

      24576:n3TlQecqWNtXw9vBw517N8MocQqpKp68HRXYA6TmnQEPY1478eADQloZytIfN8:nfcVNt4W5H1f46oRIibQm787DQztI18

    Score
    6/10
    bootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral7behavioral8

    • Target

      Homepage.url

    • Size

      95B

    • MD5

      af7470f1aa0a6d2633063e216cf77d53

    • SHA1

      16b15e79e61019ce7155b2e42d6c6bf1e067ca20

    • SHA256

      9989a5b161e31fccecf852a1b315952f3ba23753a536100dd6b6be2c79725f8a

    • SHA512

      b292f0aa16ea15aed39a5cefbb3f0b2d2458c9b9ccc28571a0f4ffbe9ebb1d9a14d865a28ef49460eb7a646075029ae100e37a26a396316db22ca2018e6cc31f

    Score
    6/10
    evasiontrojan
    behavioral10behavioral9

    • Target

      Uninst.exe

    • Size

      61KB

    • MD5

      a23e32558943a21230e150891a314024

    • SHA1

      f4ee54e8935356de28ed2504dee72bc01472a6b2

    • SHA256

      210eca187141a52069831e79e2c22bd5c89111bfc4ddcff0c91bbad290ba4728

    • SHA512

      341858c56ca18a943928215bf0440bc02d94729fea5004ea13beae27fbcfe637629a53dd74d407f30b6513c98c87db3d98cf4a04c67f8afa6b5ba03a7b254bb0

    • SSDEEP

      768:hMEFP4CyxRyQR4Dk1b+/JwwXVPYwitff/ff6FS6sekJkOQc142FtWwSICP8nn3gz:jPJc2WCMNv0kJfQcREYRNgSuD3

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      dbfmanager.chm

    • Size

      35KB

    • MD5

      fc5f5e95243211b006dabdffb7b249ac

    • SHA1

      7ec3a90eace3c5a0507fd4e4ffef72118220cb93

    • SHA256

      f0ae4e9b124363002d276b2f865e4ec2978a764ff0ca45890a054624b25ea526

    • SHA512

      8a22b72c068635728c6ae85509c0bfb1e8cb9b55216a8359bf69089e88a98da20dbf65c2129c533bf78643d3a8b0e40ae5b4267a1e98d0e0c7940e0a6952fba2

    • SSDEEP

      768:HGPcShwNLPrLcGY4PHKoXhrDjGTUB9tMMteU:HGlhw9PrLhBl+gyM8U

    Score
    1/10
    behavioral13behavioral14

MITRE ATT&CK Enterprise v15

Tasks