Overview

overview

10

Static

static

10

07539fbae4...18.exe

windows7-x64

10

07539fbae4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07539fbae4f0506bb52e86f7fc5dd695_JaffaCakes118

  • Size

    6.4MB

  • Sample

    240728-dz3vnsyflg

  • MD5

    07539fbae4f0506bb52e86f7fc5dd695

  • SHA1

    0cff35def432dca04a4ec9026487727582f1be50

  • SHA256

    49e5353bb73ca1af61934b468981ba6d35d6dcbf9bcc4c96b0ae39ddcab8ce0d

  • SHA512

    d1f1373cd6f7d9939003e32b68fc9e132c7c57722accb907f5ebbea39d6af4557602cd6bd3fac3cc0815a96685fa3587b40036899c83c61a78eaefe249d8a838

  • SSDEEP

    98304:o7+akjAyFdm5suUjui/GRW4Y4HBKL/vaAjkq9FWL79k:4+aknuUXEW4YKQaKkOWLpk

Score
10/10
gozixmrigisfbminerupx

Malware Config

Extracted

Family

gozi

Targets

    • Target

      07539fbae4f0506bb52e86f7fc5dd695_JaffaCakes118

    • Size

      6.4MB

    • MD5

      07539fbae4f0506bb52e86f7fc5dd695

    • SHA1

      0cff35def432dca04a4ec9026487727582f1be50

    • SHA256

      49e5353bb73ca1af61934b468981ba6d35d6dcbf9bcc4c96b0ae39ddcab8ce0d

    • SHA512

      d1f1373cd6f7d9939003e32b68fc9e132c7c57722accb907f5ebbea39d6af4557602cd6bd3fac3cc0815a96685fa3587b40036899c83c61a78eaefe249d8a838

    • SSDEEP

      98304:o7+akjAyFdm5suUjui/GRW4Y4HBKL/vaAjkq9FWL79k:4+aknuUXEW4YKQaKkOWLpk

    Score
    10/10
    xmrigminerupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks