General

  • Target

    d37240a8e11a1cd9d519382742979e45_JaffaCakes118

  • Size

    543KB

  • Sample

    240908-d52vkawanh

  • MD5

    d37240a8e11a1cd9d519382742979e45

  • SHA1

    f5989f41215dd5caf0b0782fdd6f2f54e8b6caf7

  • SHA256

    ce5e9c20abd27bb7d81c53e2c5155b347aa0ee4df71e002375cb467e4a5c09b8

  • SHA512

    697815a69d005bf844ed16154641a97b93bcc93a23eae6b92007433d5735e68656d5cc3cb7f8046b77e374f122dc67b4de3134833883c39c63b0004008887cf6

  • SSDEEP

    12288:G2VzZDp7JeUQAy+k/Kw9L0DFZ/E8OqpfmG3ILAxWP9V0q:GGeV9L+/Ejqpfm8IExWP9V0q

Malware Config

Extracted

Family

systembc

C2

138.197.141.150:4005

protoukt.com:4005

Attributes
  • dns

    5.132.191.104

    92.163.33.248

    206.189.120.27

Targets

    • Target

      d37240a8e11a1cd9d519382742979e45_JaffaCakes118

    • Size

      543KB

    • MD5

      d37240a8e11a1cd9d519382742979e45

    • SHA1

      f5989f41215dd5caf0b0782fdd6f2f54e8b6caf7

    • SHA256

      ce5e9c20abd27bb7d81c53e2c5155b347aa0ee4df71e002375cb467e4a5c09b8

    • SHA512

      697815a69d005bf844ed16154641a97b93bcc93a23eae6b92007433d5735e68656d5cc3cb7f8046b77e374f122dc67b4de3134833883c39c63b0004008887cf6

    • SSDEEP

      12288:G2VzZDp7JeUQAy+k/Kw9L0DFZ/E8OqpfmG3ILAxWP9V0q:GGeV9L+/Ejqpfm8IExWP9V0q

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks