Overview

overview

7

Static

static

7

fa9638a6a3...18.exe

windows7-x64

7

fa9638a6a3...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    fa9638a6a334baced7199d6043dc3f89_JaffaCakes118

  • Size

    2.1MB

  • Sample

    240927-r1dttsxbrp

  • MD5

    fa9638a6a334baced7199d6043dc3f89

  • SHA1

    5db1143a471eecc424ef0c1ecbaf137fd9285062

  • SHA256

    86686a2cd135ff852eb7ce1644a4ccbd541bb0e43ed328f4adf71db4121eb06d

  • SHA512

    d069016c0791d5f5825098446d49067a86015aece6a735c2c449fb820a7fd6daa2a2640c23a05badb64b50da23a2e0c99b6524e868d8cc3b59d0d82aef7c425a

  • SSDEEP

    49152:fxWcDC7gLD69dtxCj7pejqJDj2QgLD05kLnc/xyrYIhhUm:f7DC7gLwTCjVRJ/sECEx2Mm

Score
7/10
discoveryevasionthemida

Malware Config

Targets

    • Target

      fa9638a6a334baced7199d6043dc3f89_JaffaCakes118

    • Size

      2.1MB

    • MD5

      fa9638a6a334baced7199d6043dc3f89

    • SHA1

      5db1143a471eecc424ef0c1ecbaf137fd9285062

    • SHA256

      86686a2cd135ff852eb7ce1644a4ccbd541bb0e43ed328f4adf71db4121eb06d

    • SHA512

      d069016c0791d5f5825098446d49067a86015aece6a735c2c449fb820a7fd6daa2a2640c23a05badb64b50da23a2e0c99b6524e868d8cc3b59d0d82aef7c425a

    • SSDEEP

      49152:fxWcDC7gLD69dtxCj7pejqJDj2QgLD05kLnc/xyrYIhhUm:f7DC7gLwTCjVRJ/sECEx2Mm

    Score
    7/10
    discoveryevasionthemida

    • Deletes itself

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks