General

  • Target

    d474d297414d3414f9603571b5500c84_JaffaCakes118

  • Size

    80KB

  • Sample

    240908-qlmyhszhke

  • MD5

    d474d297414d3414f9603571b5500c84

  • SHA1

    e5638980e34561dfe5c18c85ad2f2a22d799c615

  • SHA256

    3f8226384841f4108654edfd3b00f9beb30bcfb6278347c3c79a67cfb4b44752

  • SHA512

    2af4faf620a9138f028966bf8a1f61b170054bca1f81f86a9cc9a6cb09f023ce04e248f8b151997f277a64beac1a60c78b8e1d98482c4b8f26ae9599dbc7b65b

  • SSDEEP

    1536:D16X8VjLLtT2lCVCtFgWa8ae6FvqXM4mOIwcI:J1HxVCtF08X/QA

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      d474d297414d3414f9603571b5500c84_JaffaCakes118

    • Size

      80KB

    • MD5

      d474d297414d3414f9603571b5500c84

    • SHA1

      e5638980e34561dfe5c18c85ad2f2a22d799c615

    • SHA256

      3f8226384841f4108654edfd3b00f9beb30bcfb6278347c3c79a67cfb4b44752

    • SHA512

      2af4faf620a9138f028966bf8a1f61b170054bca1f81f86a9cc9a6cb09f023ce04e248f8b151997f277a64beac1a60c78b8e1d98482c4b8f26ae9599dbc7b65b

    • SSDEEP

      1536:D16X8VjLLtT2lCVCtFgWa8ae6FvqXM4mOIwcI:J1HxVCtF08X/QA

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks