Overview

overview

10

Static

static

3

20a43f57dc...18.exe

windows7-x64

10

20a43f57dc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20a43f57dc505ffac0da8b49d91fd322_JaffaCakes118

  • Size

    152KB

  • Sample

    241008-kql9wssame

  • MD5

    20a43f57dc505ffac0da8b49d91fd322

  • SHA1

    ee9132b380e1307a283dcca9a7e54fcf333aa4d6

  • SHA256

    ae83f208925ec791bd10f37e0cd1bfc98473ea586c4814288a243c7d579c2e55

  • SHA512

    c10d6dfec99f6b91235d7f619e12ef56d432faa36e53da9d4469dad87ad5206628992d2b7258b48d0e1dfa5a9d011cbd2f421bdd2d48f9c72ef11e45addea625

  • SSDEEP

    3072:/xEJpxEqxE2wzTvvfQ+2U4gzEy2fAC4wrw9xEAxEKxEJ:pEJ7EAE2l3Dp6EmEgEJ

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      20a43f57dc505ffac0da8b49d91fd322_JaffaCakes118

    • Size

      152KB

    • MD5

      20a43f57dc505ffac0da8b49d91fd322

    • SHA1

      ee9132b380e1307a283dcca9a7e54fcf333aa4d6

    • SHA256

      ae83f208925ec791bd10f37e0cd1bfc98473ea586c4814288a243c7d579c2e55

    • SHA512

      c10d6dfec99f6b91235d7f619e12ef56d432faa36e53da9d4469dad87ad5206628992d2b7258b48d0e1dfa5a9d011cbd2f421bdd2d48f9c72ef11e45addea625

    • SSDEEP

      3072:/xEJpxEqxE2wzTvvfQ+2U4gzEy2fAC4wrw9xEAxEKxEJ:pEJ7EAE2l3Dp6EmEgEJ

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks