General

  • Target

    e494b5daffa1d5f315bf6d1e373fdf5a_JaffaCakes118

  • Size

    84KB

  • Sample

    240916-mlbcyasglp

  • MD5

    e494b5daffa1d5f315bf6d1e373fdf5a

  • SHA1

    10e2b8551e14f7132b04705d9653993b89e8d6e8

  • SHA256

    c22fbcb8ff6368ef91aa41506a3d83ad132d03362cb573feb269fe846941cb65

  • SHA512

    aacf82784cf45f753705d4373bee8b19d1fe0a3b47e0628ad5d03981d0d785c3668ec8b8b96eaf6dc1064b9c1e805e3ddd7f2b38e2c1907e82ba006e63cf38c1

  • SSDEEP

    1536:r43jWVsle6wq5MQT8jr11mn6xeYh6SZMDHoqtLy:rmfleLq5MQT8jhon6xR6/oeL

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      e494b5daffa1d5f315bf6d1e373fdf5a_JaffaCakes118

    • Size

      84KB

    • MD5

      e494b5daffa1d5f315bf6d1e373fdf5a

    • SHA1

      10e2b8551e14f7132b04705d9653993b89e8d6e8

    • SHA256

      c22fbcb8ff6368ef91aa41506a3d83ad132d03362cb573feb269fe846941cb65

    • SHA512

      aacf82784cf45f753705d4373bee8b19d1fe0a3b47e0628ad5d03981d0d785c3668ec8b8b96eaf6dc1064b9c1e805e3ddd7f2b38e2c1907e82ba006e63cf38c1

    • SSDEEP

      1536:r43jWVsle6wq5MQT8jr11mn6xeYh6SZMDHoqtLy:rmfleLq5MQT8jhon6xR6/oeL

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks