General
-
Target
c1c1097b11c6a0ddcb73198c735ac9d2_JaffaCakes118
-
Size
468KB
-
Sample
240825-2s3hbszbrc
-
MD5
c1c1097b11c6a0ddcb73198c735ac9d2
-
SHA1
ad6cb9943e0cdb8002515977575b700eb7c924d5
-
SHA256
2abf123760ce591be9d9800c55f6e57a3f1513900cffd315c982ff2632bdf32d
-
SHA512
70b550ecee1d01b2cc66098495122396c3d351b654496b6f51be22cb700ef3895a89cb1e8df5dce8694068f31182fa4a49258b537268a256dea6c8642a6f3e1a
-
SSDEEP
6144:4/0uot1GgR3uydqvZ4qJ72wdCF280UupTdPPcV7U/6gju8mvES0935/Y/uU4leFa:4J6p3uQq2kKiC0+6Pk+CO0E9pC8AJW
Malware Config
Targets
-
-
Target
Terrylightspeed.com.07.07.04.walking.in.the.park.imageset-hawt.exe
-
Size
468KB
-
MD5
abeef953003329c7d3a62813b19b92a4
-
SHA1
5f913d91b3a931c603e246fae1daa5e58717b480
-
SHA256
3921f5138313a91e71c544e8c8fac59a42ebe8f153b7ee341bef2bde3cc7f79c
-
SHA512
2d41b4784c419d750064726586af2bd0051ed002cf55b74d85cb1d4f3769ca1fc211c6f9a2e9b1408e70528bec51b1bbad0fda3c85b1817a0afc1e9cc1995c5b
-
SSDEEP
6144:F/0uot1GgR3uydqvZ4qJ72wdCF280UupTdPPcV7U/6gju8mvES0935/Y/uU4leF5:FJ6p3uQq2kKiC0+6Pk+CO0E9pC8AJ1
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Drops file in System32 directory
-