General

  • Target

    ecec64ff5ce641a4a1f05deb155d6653_JaffaCakes118

  • Size

    1KB

  • Sample

    240920-f5ages1aqc

  • MD5

    ecec64ff5ce641a4a1f05deb155d6653

  • SHA1

    667b41d91c36d624fb0d7d08c19eb973af38d67b

  • SHA256

    e8e6b762a9821d12a4df9a03ba70d24c1b635a83f97487f477ceb7592f4aceee

  • SHA512

    ef9aba73378d49be846a435de3d280fc239710545e3762b48920ee7a8af2508907ef84cd29670d3622895214f1a2f852df41d4372dd23d00d20e7d3ec1399f58

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://fs05n4.sendspace.com/dl/a948bd21e0b879fdb7c01047131595ff/59b09db20625e3ed/ehlbqu/Server.exe

Targets

    • Target

      ecec64ff5ce641a4a1f05deb155d6653_JaffaCakes118

    • Size

      1KB

    • MD5

      ecec64ff5ce641a4a1f05deb155d6653

    • SHA1

      667b41d91c36d624fb0d7d08c19eb973af38d67b

    • SHA256

      e8e6b762a9821d12a4df9a03ba70d24c1b635a83f97487f477ceb7592f4aceee

    • SHA512

      ef9aba73378d49be846a435de3d280fc239710545e3762b48920ee7a8af2508907ef84cd29670d3622895214f1a2f852df41d4372dd23d00d20e7d3ec1399f58

    Score
    10/10
    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks