Overview

overview

10

Static

static

3

f9c019b6a0...18.exe

windows7-x64

10

f9c019b6a0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9c019b6a0f1ce8802a8aaeea86e496d_JaffaCakes118

  • Size

    6.3MB

  • Sample

    240927-fj9z6awdlr

  • MD5

    f9c019b6a0f1ce8802a8aaeea86e496d

  • SHA1

    7f854b600823ec15cd6bb5c912ea3a28f64da16a

  • SHA256

    0f2164f4d235938313afcfbd8c660804b219066e6b25b80943fe8d9a2817b8ae

  • SHA512

    5cb690fc9524678998ad9b022cde4c9ee09e7863e7af52d1d6dab854a30036edb883b9ebe8b7613777aee6d0132a365d17697ae516fd10f88f1162c527b2afae

  • SSDEEP

    196608:WPfaOYMRlp30bgwOGcjwppBR5dgI8H++:WKhMRlN0bgXGGwpj5gI8e

Score
10/10
rmsdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      f9c019b6a0f1ce8802a8aaeea86e496d_JaffaCakes118

    • Size

      6.3MB

    • MD5

      f9c019b6a0f1ce8802a8aaeea86e496d

    • SHA1

      7f854b600823ec15cd6bb5c912ea3a28f64da16a

    • SHA256

      0f2164f4d235938313afcfbd8c660804b219066e6b25b80943fe8d9a2817b8ae

    • SHA512

      5cb690fc9524678998ad9b022cde4c9ee09e7863e7af52d1d6dab854a30036edb883b9ebe8b7613777aee6d0132a365d17697ae516fd10f88f1162c527b2afae

    • SSDEEP

      196608:WPfaOYMRlp30bgwOGcjwppBR5dgI8H++:WKhMRlN0bgXGGwpj5gI8e

    Score
    10/10
    rmsdiscoverypersistencerattrojan

    • Modifies WinLogon for persistence

      persistence

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks