Overview

overview

10

Static

static

3

ffb53d4baa...18.exe

windows7-x64

10

ffb53d4baa...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffb53d4baa4fe8f029a12ea4cbe9ff5c_JaffaCakes118

  • Size

    854KB

  • Sample

    240930-b7szbswanf

  • MD5

    ffb53d4baa4fe8f029a12ea4cbe9ff5c

  • SHA1

    6d0c95f3ec69a262ccd5b91c1ca399059d846427

  • SHA256

    ca354f62593392f73b308327968dd673d39a4c4c694456f203720e8db0a877f5

  • SHA512

    e0b6a06124c48c775ade65cf3480921fbcc10d4fda48dcc714fba1bce2e28c88ae2eabb62f31670763797af4248c9d68c640f23922a1ca90bff4ba115326dc96

  • SSDEEP

    24576:5vCotMeauERKuzDGpTWm6AXOkyvifxSClcoa+Sgnf:HnasumqnGOnvcxSClha+fnf

Score
10/10
runningratdiscoveryrat

Malware Config

Targets

    • Target

      ffb53d4baa4fe8f029a12ea4cbe9ff5c_JaffaCakes118

    • Size

      854KB

    • MD5

      ffb53d4baa4fe8f029a12ea4cbe9ff5c

    • SHA1

      6d0c95f3ec69a262ccd5b91c1ca399059d846427

    • SHA256

      ca354f62593392f73b308327968dd673d39a4c4c694456f203720e8db0a877f5

    • SHA512

      e0b6a06124c48c775ade65cf3480921fbcc10d4fda48dcc714fba1bce2e28c88ae2eabb62f31670763797af4248c9d68c640f23922a1ca90bff4ba115326dc96

    • SSDEEP

      24576:5vCotMeauERKuzDGpTWm6AXOkyvifxSClcoa+Sgnf:HnasumqnGOnvcxSClha+fnf

    Score
    10/10
    runningratdiscoveryrat

    • RunningRat

      RunningRat is a remote access trojan first seen in 2018.

      ratrunningrat

    • RunningRat payload

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks