Overview

overview

10

Static

static

10

37278f8113...18.rar

windows7-x64

1

37278f8113...18.rar

windows10-2004-x64

1

DuoWei.dll

windows7-x64

10

DuoWei.dll

windows10-2004-x64

5

Providence.exe

windows7-x64

10

Providence.exe

windows10-2004-x64

10

idix.dll

windows7-x64

3

idix.dll

windows10-2004-x64

3

请先下�....0.url

windows7-x64

1

请先下�....0.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37278f8113745774640f5b647de0bf7a_JaffaCakes118

  • Size

    130KB

  • MD5

    37278f8113745774640f5b647de0bf7a

  • SHA1

    ec633bb28de73082fc3c08cdca464da47e874471

  • SHA256

    e5bb20f9f11465cc01d24f5a9c27d4643af924e8b2a03b0d5e109aa15968944b

  • SHA512

    52b2c6f6f2dbfa03c94ff9bb5a2c6ee27341e2f4832540feeff27a0248bae2b5b8cd34dece30c34cc30b53bab9f6d9d44d50081087a10f9f856622781e710ba9

  • SSDEEP

    3072:5upCvIDP3BuE84SO5fmDzpHknxq8swJC8PXtCmJrFUU:oMSGFcoHUxq8jJC8YmUU

Score
10/10
upxstealerblackmoonrevengerat

Malware Config

Signatures

  • Blackmoon family
    blackmoon
  • Detect Blackmoon payload 1 IoCs
  • RevengeRat Executable 1 IoCs
    stealer
  • Revengerat family
    revengerat
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • 37278f8113745774640f5b647de0bf7a_JaffaCakes118
    .rar .ps1 polyglot
  • DuoWei.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • Providence.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • idix.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 请先下载安装.NETFramework4.0.url