Overview

overview

10

Static

static

3

55b4460e9d...18.exe

windows7-x64

10

55b4460e9d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55b4460e9dc7cd58d74976df231389de_JaffaCakes118

  • Size

    152KB

  • Sample

    241018-f6ahtasgnk

  • MD5

    55b4460e9dc7cd58d74976df231389de

  • SHA1

    de90a89c267a64f2ace75cd9f27d9bbbc7dbbd80

  • SHA256

    bb84e516851ec948d169ef7b84cfaedbe4db5b8e8ddd16edfacd3c012a6165fc

  • SHA512

    e48f1ccc34c6ccde92b34ca69ba9822cbddbcd306230acc659cb1451c92127178b50471fa75a699b7d47dc827c841c0541583aeec338e0e65a94dd598785f040

  • SSDEEP

    1536:3kOzGXoo9jfz6+QixT9kPVtBR7txlr1ENsV9DqJV:0PrjrOeZYBBrMO5U

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      55b4460e9dc7cd58d74976df231389de_JaffaCakes118

    • Size

      152KB

    • MD5

      55b4460e9dc7cd58d74976df231389de

    • SHA1

      de90a89c267a64f2ace75cd9f27d9bbbc7dbbd80

    • SHA256

      bb84e516851ec948d169ef7b84cfaedbe4db5b8e8ddd16edfacd3c012a6165fc

    • SHA512

      e48f1ccc34c6ccde92b34ca69ba9822cbddbcd306230acc659cb1451c92127178b50471fa75a699b7d47dc827c841c0541583aeec338e0e65a94dd598785f040

    • SSDEEP

      1536:3kOzGXoo9jfz6+QixT9kPVtBR7txlr1ENsV9DqJV:0PrjrOeZYBBrMO5U

    Score
    10/10
    guloaderdiscoverydownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks