Overview

overview

10

Static

static

3

f02f5716cf...18.exe

windows7-x64

7

f02f5716cf...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f02f5716cfe88fc8d7d4c15f60a8a021_JaffaCakes118

  • Size

    339KB

  • Sample

    240921-tw6eds1gqh

  • MD5

    f02f5716cfe88fc8d7d4c15f60a8a021

  • SHA1

    1a46a0f597816da380891902f9f46c69c8f0e5a8

  • SHA256

    ac85218079883ff68b6d74a779d9c997cf766d572545d8663d8adf0fd1de8ffe

  • SHA512

    dcfdc94dcf7d365c5c9785abdc0f529a50f71a15a6f79a90f267c746eca9c8fb62778782f154bbc2d6c8965b48b42ae3e7256caeb3d5872f8814af1b3117b980

  • SSDEEP

    6144:Yl0k35P1KamRQ+2kl3F+3ebiTGTUaHiIkpiOcA+EZr0dawtE6d:Yl0knWjVF+Ob+GTBZk8bE90da56

Score
10/10
imminentdiscoverypersistencespywaretrojan

Malware Config

Targets

    • Target

      f02f5716cfe88fc8d7d4c15f60a8a021_JaffaCakes118

    • Size

      339KB

    • MD5

      f02f5716cfe88fc8d7d4c15f60a8a021

    • SHA1

      1a46a0f597816da380891902f9f46c69c8f0e5a8

    • SHA256

      ac85218079883ff68b6d74a779d9c997cf766d572545d8663d8adf0fd1de8ffe

    • SHA512

      dcfdc94dcf7d365c5c9785abdc0f529a50f71a15a6f79a90f267c746eca9c8fb62778782f154bbc2d6c8965b48b42ae3e7256caeb3d5872f8814af1b3117b980

    • SSDEEP

      6144:Yl0k35P1KamRQ+2kl3F+3ebiTGTUaHiIkpiOcA+EZr0dawtE6d:Yl0knWjVF+Ob+GTBZk8bE90da56

    Score
    10/10
    discoveryimminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks