Overview

overview

10

Static

static

10

ffff18fc7c...18.exe

windows7-x64

10

ffff18fc7c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffff18fc7c2166c2a1a3c3d8bbd95ba1_JaffaCakes118

  • Size

    421KB

  • Sample

    240930-fd8j5syfll

  • MD5

    ffff18fc7c2166c2a1a3c3d8bbd95ba1

  • SHA1

    7af27ee542f599e4b68a032bc43295eec03c1e0e

  • SHA256

    a7a86cbf520c0ca37e2f8e37584fcd9c68e79614fd8352d10a7bb223c3a3a39b

  • SHA512

    3a36a1b6cf4b933cc546157b51a48e0b87fd1bc9fc41b5763500ecf89fca7017e2fdc721593ff6eaa2607b434c4d0133132460f1d090d5f459905f410a4c1435

  • SSDEEP

    3072:lZJcY3O6a2iEWp5xINI4OIiwuGgmBZDG3StAjr2kMczzydo/vX9VT:/JcYEPtdINI4OIi3D3StNynyS/fvT

Score
10/10
golddragonbackdoordiscovery

Malware Config

Targets

    • Target

      ffff18fc7c2166c2a1a3c3d8bbd95ba1_JaffaCakes118

    • Size

      421KB

    • MD5

      ffff18fc7c2166c2a1a3c3d8bbd95ba1

    • SHA1

      7af27ee542f599e4b68a032bc43295eec03c1e0e

    • SHA256

      a7a86cbf520c0ca37e2f8e37584fcd9c68e79614fd8352d10a7bb223c3a3a39b

    • SHA512

      3a36a1b6cf4b933cc546157b51a48e0b87fd1bc9fc41b5763500ecf89fca7017e2fdc721593ff6eaa2607b434c4d0133132460f1d090d5f459905f410a4c1435

    • SSDEEP

      3072:lZJcY3O6a2iEWp5xINI4OIiwuGgmBZDG3StAjr2kMczzydo/vX9VT:/JcYEPtdINI4OIi3D3StNynyS/fvT

    Score
    10/10
    golddragonbackdoordiscovery

    • GoldDragon

      GoldDragon is a second-stage backdoor attributed to Kimsuky.

      backdoorgolddragon

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks