Overview

overview

10

Static

static

3

3e263a2412...18.exe

windows7-x64

10

3e263a2412...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e263a24122e03e6793a491bfda7942a_JaffaCakes118

  • Size

    5.6MB

  • Sample

    241013-gjc6vswepl

  • MD5

    3e263a24122e03e6793a491bfda7942a

  • SHA1

    cdf6e4849974c1fbd5d3075fcce91eea4f58dac1

  • SHA256

    d0b4b43432238e361c9f553caa05df5c34c462d55bb18a6db5e076faaaf05da9

  • SHA512

    e68e2744030ba73e40411c12fe3b0e1a3b965249f8f1b3564833c3f3d2e8f90d2725e105a9c742bfb3dc2ad13ec2a1a38fefdb07badbcda84dcc3cdc067981b9

  • SSDEEP

    98304:v/rXIHsZBxIj0Hnk/mA5P/BINhs1DUUmEiqeWTGnuHnJTvGQUd6kt:MHoIP5P/GNyioyup6Qzk

Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target

      3e263a24122e03e6793a491bfda7942a_JaffaCakes118

    • Size

      5.6MB

    • MD5

      3e263a24122e03e6793a491bfda7942a

    • SHA1

      cdf6e4849974c1fbd5d3075fcce91eea4f58dac1

    • SHA256

      d0b4b43432238e361c9f553caa05df5c34c462d55bb18a6db5e076faaaf05da9

    • SHA512

      e68e2744030ba73e40411c12fe3b0e1a3b965249f8f1b3564833c3f3d2e8f90d2725e105a9c742bfb3dc2ad13ec2a1a38fefdb07badbcda84dcc3cdc067981b9

    • SSDEEP

      98304:v/rXIHsZBxIj0Hnk/mA5P/BINhs1DUUmEiqeWTGnuHnJTvGQUd6kt:MHoIP5P/GNyioyup6Qzk

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks