vobfus | a8a1f7bdc2077e273f5fe69b4254ba42473b5db8061548f3ad8c35d990faa3e7 | Triage

Submit
Reports

Overview

overview

Static

static

3

c66a1261aa...18.exe

windows7-x64

c66a1261aa...18.exe

windows10-2004-x64

Sharing

General

Target

c66a1261aafecfa89f1a18e2d022f659_JaffaCakes118
Size

157KB
Sample

240828-h5t7ya1crr
MD5

c66a1261aafecfa89f1a18e2d022f659
SHA1

80aa9859eea5c2e372cb4cec757dbdd6c6609586
SHA256

a8a1f7bdc2077e273f5fe69b4254ba42473b5db8061548f3ad8c35d990faa3e7
SHA512

4344e0006be67469b1b9e91dd5c2be658778e47da0e0687b3fd4fdfa4ea65ad7735a9f7d09e1190feae0cf6b2b21a06a0f8eb303f073422cc26088ec1da4ff18
SSDEEP

3072:cfI2gRG77z+b4Q8iagSd/m0bnZzqWPNnoa0zNwbGDMjQ20yuHZ231drLRWEmRwm9:wno87zw8Omm0TtqWPNnp0dY6H431dBWj

Score

10^/10

vobfus discovery persistence upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c66a1261aafecfa89f1a18e2d022f659_JaffaCakes118.exe

Resource

win7-20240704-en

vobfus discovery persistence upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

c66a1261aafecfa89f1a18e2d022f659_JaffaCakes118.exe

Resource

win10v2004-20240802-en

vobfus discovery persistence upx worm

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  c66a1261aafecfa89f1a18e2d022f659_JaffaCakes118
- Size
  
  157KB
- MD5
  
  c66a1261aafecfa89f1a18e2d022f659
- SHA1
  
  80aa9859eea5c2e372cb4cec757dbdd6c6609586
- SHA256
  
  a8a1f7bdc2077e273f5fe69b4254ba42473b5db8061548f3ad8c35d990faa3e7
- SHA512
  
  4344e0006be67469b1b9e91dd5c2be658778e47da0e0687b3fd4fdfa4ea65ad7735a9f7d09e1190feae0cf6b2b21a06a0f8eb303f073422cc26088ec1da4ff18
- SSDEEP
  
  3072:cfI2gRG77z+b4Q8iagSd/m0bnZzqWPNnoa0zNwbGDMjQ20yuHZ231drLRWEmRwm9:wno87zw8Omm0TtqWPNnp0dY6H431dBWj
Score

10^/10

vobfus discovery persistence upx worm
- Vobfus
  A widespread worm which spreads via network drives and removable media.
  worm vobfus
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vobfusdiscoverypersistenceupxworm

behavioral2

vobfusdiscoverypersistenceupxworm

© 2018-2025

Terms | Privacy