Overview

overview

10

Static

static

7

7984795034...18.exe

windows7-x64

10

7984795034...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7984795034356e98ee58d8dc22528b37_JaffaCakes118

  • Size

    2.7MB

  • Sample

    240730-wrtadawcra

  • MD5

    7984795034356e98ee58d8dc22528b37

  • SHA1

    59f6121fa70794c5db6876681eab7884f85f2a65

  • SHA256

    c0548aad351aff17865b157dd1656f4f5a6c039aba4e0bb03810382730e860ef

  • SHA512

    1776ff7c5ad9b4111a4bc187e52e595b1215d8e5b61af2e64ebcc193ed0690f9c5524dc2d9d6afffbf65bff1bf9a1a0428749f0ee9ea7e1962e90d9efe801161

  • SSDEEP

    49152:OPwJWVpV90FiuOVP7z6s375OZusxqik2bJRiAJV6aSaoo:OYJSr26jL5OgqqQjYr

Score
10/10
sectopratdiscoveryevasionratthemidatrojan

Malware Config

Targets

    • Target

      7984795034356e98ee58d8dc22528b37_JaffaCakes118

    • Size

      2.7MB

    • MD5

      7984795034356e98ee58d8dc22528b37

    • SHA1

      59f6121fa70794c5db6876681eab7884f85f2a65

    • SHA256

      c0548aad351aff17865b157dd1656f4f5a6c039aba4e0bb03810382730e860ef

    • SHA512

      1776ff7c5ad9b4111a4bc187e52e595b1215d8e5b61af2e64ebcc193ed0690f9c5524dc2d9d6afffbf65bff1bf9a1a0428749f0ee9ea7e1962e90d9efe801161

    • SSDEEP

      49152:OPwJWVpV90FiuOVP7z6s375OZusxqik2bJRiAJV6aSaoo:OYJSr26jL5OgqqQjYr

    Score
    10/10
    sectopratdiscoveryevasionratthemidatrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks