ssend
Static task
static1
Behavioral task
behavioral1
Sample
BetaMT2-SPOL(PL)/BetaMT2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
BetaMT2-SPOL(PL)/BetaMT2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
BetaMT2-SPOL(PL)/mc.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
BetaMT2-SPOL(PL)/mc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
BetaMT2-SPOL(PL)/mc.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
BetaMT2-SPOL(PL)/mc.exe
Resource
win10v2004-20241007-en
General
-
Target
3eb258f468ab155afbcff43975b8c071_JaffaCakes118
-
Size
888KB
-
MD5
3eb258f468ab155afbcff43975b8c071
-
SHA1
e71ea76b0365562c4167e7f4ebc913d5bdaf0588
-
SHA256
c2fa6a60a86e1bf83a0026ed0363eaeb389a2dba0155b176d9f7c9930d2a7b23
-
SHA512
769065f46425eb30b47cc18703f89788e7bb3d7ca27e976338e3f3e3624ce6a0cf39d63388f4a54440cb2fa0d6f0ac34cd8cc208f67afd0382a43d3de03c2627
-
SSDEEP
24576:h5Zm5m+k4lYxtUNp1E6RJo8moZe6z1FyLh:h5Q5NatiEEPmoZVpoN
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/BetaMT2-SPOL(PL)/BetaMT2.exe unpack001/BetaMT2-SPOL(PL)/mc.dll unpack001/BetaMT2-SPOL(PL)/mc.exe
Files
-
3eb258f468ab155afbcff43975b8c071_JaffaCakes118.rar
-
BetaMT2-SPOL(PL)/BetaMT2.exe.exe windows:4 windows x86 arch:x86
d125cbfd58b5d667bfdda48f6d313795
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetSystemMetrics
wsprintfA
MessageBoxA
CreateIconFromResource
SetWindowRgn
CreateWindowExA
SetWindowPos
PostThreadMessageA
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowThreadProcessId
IsWindow
CallNextHookEx
FillRect
GetSysColor
GetDC
TrackMouseEvent
GetParent
InvalidateRect
MoveWindow
GetClassInfoExA
PostQuitMessage
CallWindowProcA
ReleaseCapture
EndPaint
TranslateMessage
DispatchMessageA
ReleaseDC
DrawTextA
DrawIconEx
SendMessageA
BeginPaint
GetWindowDC
GetWindowRect
GetWindowTextA
DefWindowProcA
RegisterClassExA
LoadCursorA
LoadIconA
ShowWindow
WaitForInputIdle
GetMessageA
kernel32
GlobalFree
MulDiv
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SuspendThread
ResumeThread
GetExitCodeThread
TerminateThread
GetCurrentThreadId
GetProcessHeap
ExitProcess
HeapAlloc
GlobalLock
GlobalUnlock
LCMapStringA
GetTickCount
SetFilePointer
ReadFile
CreateFileA
WriteFile
GetModuleFileNameA
IsBadReadPtr
HeapFree
CreateFileMappingA
MapViewOfFile
RtlMoveMemory
lstrcpyn
CreateProcessA
WaitForSingleObject
CloseHandle
LoadLibraryA
GetCurrentDirectoryA
LocalAlloc
RtlFillMemory
LocalFree
LocalSize
GetModuleHandleA
GetProcAddress
FreeLibrary
GlobalAlloc
HeapReAlloc
gdi32
CreateCompatibleDC
SelectObject
SetBkMode
SetTextColor
CreateFontA
BitBlt
DeleteObject
DeleteDC
StretchBlt
GetObjectA
CreateSolidBrush
CreateDCA
GetDeviceCaps
CreateRoundRectRgn
CreateCompatibleBitmap
ole32
CreateStreamOnHGlobal
olepro32
ord251
msvcrt
_ftol
??2@YAPAXI@Z
free
strncpy
realloc
malloc
sprintf
srand
rand
strtod
??3@YAXPAX@Z
modf
shlwapi
PathFileExistsA
Sections
.text Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 344KB - Virtual size: 343KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
BetaMT2-SPOL(PL)/mc.dll.dll windows:4 windows x86 arch:x86
3978f332df7e85d1052bb202312e9396
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenFileMappingA
MapViewOfFile
CloseHandle
LocalAlloc
LocalFree
lstrcpyn
lstrlenA
RtlMoveMemory
GetModuleHandleA
GetProcAddress
RtlFillMemory
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
SuspendThread
ResumeThread
GetExitCodeThread
TerminateThread
GetCurrentThreadId
VirtualProtect
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
LCMapStringA
wsock32
connect
ioctlsocket
inet_addr
WSACleanup
gethostbyname
WSAStartup
user32
wsprintfA
MessageBoxA
CallWindowProcA
msvcrt
??3@YAXPAX@Z
_adjust_fdiv
_initterm
malloc
free
memmove
modf
_CIfmod
floor
sprintf
strncpy
atoi
_ftol
Exports
Exports
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BetaMT2-SPOL(PL)/mc.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 553KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 78KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 67KB - Virtual size: 380KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 77KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
BetaMT2-SPOL(PL)/mc.txt