Overview

overview

10

Static

static

3

a2e87b306d...18.exe

windows7-x64

10

a2e87b306d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2e87b306d5459d7c638c68fce19bf62_JaffaCakes118

  • Size

    188KB

  • Sample

    240817-rsxlzatbmn

  • MD5

    a2e87b306d5459d7c638c68fce19bf62

  • SHA1

    d7fb46bc9b78d33ff3820f7a10c0075209df62d1

  • SHA256

    8473f04dc7b20338dc4d954a2bfece5a50ff87e896bc85344c3938e178c18fb0

  • SHA512

    fa0d7d8f8a419887cd73f1d22c847c621d80e637371dda57bd332b567e16e45bd8262782d9a2ccfcfe3187fe4aa2de53d39ee188e39bff8a9d6442d951ca0fd4

  • SSDEEP

    3072:+wP30Vx16GfDtSvznFT8nCvp5c6fdkBC/yLzldmJWDrog6T481xfi+vFW96:gVx16GfDtIt8nCRRfdkQazlkJWDrji4q

Score
10/10
vobfusdiscoverypersistenceupxworm

Malware Config

Targets

    • Target

      a2e87b306d5459d7c638c68fce19bf62_JaffaCakes118

    • Size

      188KB

    • MD5

      a2e87b306d5459d7c638c68fce19bf62

    • SHA1

      d7fb46bc9b78d33ff3820f7a10c0075209df62d1

    • SHA256

      8473f04dc7b20338dc4d954a2bfece5a50ff87e896bc85344c3938e178c18fb0

    • SHA512

      fa0d7d8f8a419887cd73f1d22c847c621d80e637371dda57bd332b567e16e45bd8262782d9a2ccfcfe3187fe4aa2de53d39ee188e39bff8a9d6442d951ca0fd4

    • SSDEEP

      3072:+wP30Vx16GfDtSvznFT8nCvp5c6fdkBC/yLzldmJWDrog6T481xfi+vFW96:gVx16GfDtIt8nCRRfdkQazlkJWDrji4q

    Score
    10/10
    vobfusdiscoverypersistenceupxworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks