General

  • Target

    dba5b180ecb17f96d5f4736ae3708690_JaffaCakes118

  • Size

    584KB

  • Sample

    240912-cvmgfswepq

  • MD5

    dba5b180ecb17f96d5f4736ae3708690

  • SHA1

    486321367a844f5394764ea8b8345c4ca5ed1ae4

  • SHA256

    90a76d0e755eba58158e00a9f015fc022b73c767d8f146e894af4dbe01ff9b7d

  • SHA512

    ef98cc4cafe4a8aceb1d5aae856fb3e73ec8ccba073fe0ccf51f085c628357539863f25b4f8cb567a54785a895f62c9d2507adc8b95e4b1dfa5cd959fb459625

  • SSDEEP

    12288:IpNME05nKVHqy5AENDknxV3X9xWsBDzALGVoV:IpKeKyuENDkxZNxWsBfOioV

Malware Config

Extracted

Family

loaderbot

C2

http://cj40047.tmweb.ru/cmd.php

Targets

    • Target

      dba5b180ecb17f96d5f4736ae3708690_JaffaCakes118

    • Size

      584KB

    • MD5

      dba5b180ecb17f96d5f4736ae3708690

    • SHA1

      486321367a844f5394764ea8b8345c4ca5ed1ae4

    • SHA256

      90a76d0e755eba58158e00a9f015fc022b73c767d8f146e894af4dbe01ff9b7d

    • SHA512

      ef98cc4cafe4a8aceb1d5aae856fb3e73ec8ccba073fe0ccf51f085c628357539863f25b4f8cb567a54785a895f62c9d2507adc8b95e4b1dfa5cd959fb459625

    • SSDEEP

      12288:IpNME05nKVHqy5AENDknxV3X9xWsBDzALGVoV:IpKeKyuENDkxZNxWsBfOioV

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

    • LoaderBot executable

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks