General

  • Target

    166480b160f6013cbc67e8c1dc7a937b_JaffaCakes118

  • Size

    73KB

  • Sample

    241005-gfg1msydpp

  • MD5

    166480b160f6013cbc67e8c1dc7a937b

  • SHA1

    6488c38bbf570691456f0639039138ca4fbd5b48

  • SHA256

    9183b8178cc8412a505fdd0a3209afba89e67e388fef51c222f20f20d483029d

  • SHA512

    58f5f61ca47c0374b58251e60a38d672aa17a748e7c8993e794bde89351e839be33a33b9ff4b8e268ab62c0cdae9e19df5655d4e1924573b8d1920262cd9916d

  • SSDEEP

    1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRH:KCaZ2Yrb0VTXJYWEsCGuiN

Malware Config

Targets

    • Target

      166480b160f6013cbc67e8c1dc7a937b_JaffaCakes118

    • Size

      73KB

    • MD5

      166480b160f6013cbc67e8c1dc7a937b

    • SHA1

      6488c38bbf570691456f0639039138ca4fbd5b48

    • SHA256

      9183b8178cc8412a505fdd0a3209afba89e67e388fef51c222f20f20d483029d

    • SHA512

      58f5f61ca47c0374b58251e60a38d672aa17a748e7c8993e794bde89351e839be33a33b9ff4b8e268ab62c0cdae9e19df5655d4e1924573b8d1920262cd9916d

    • SSDEEP

      1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRH:KCaZ2Yrb0VTXJYWEsCGuiN

    • Banload

      Banload variants download malicious files, then install and execute the files.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks