Overview

overview

9

Static

static

7

system/ALAudio.dll

windows7-x64

3

system/ALAudio.dll

windows10-2004-x64

3

system/Core.dll

windows7-x64

3

system/Core.dll

windows10-2004-x64

3

system/D3DDrv.dll

windows7-x64

3

system/D3DDrv.dll

windows10-2004-x64

3

system/Def...32.dll

windows7-x64

3

system/Def...32.dll

windows10-2004-x64

3

system/EncVag.dll

windows7-x64

3

system/EncVag.dll

windows10-2004-x64

3

system/Engine.dll

windows7-x64

3

system/Engine.dll

windows10-2004-x64

3

system/FModeX.dll

windows7-x64

5

system/FModeX.dll

windows10-2004-x64

5

system/Fire.dll

windows7-x64

3

system/Fire.dll

windows10-2004-x64

3

system/GameGuard.dll

windows7-x64

9

system/GameGuard.dll

windows10-2004-x64

9

system/IFC23.dll

windows7-x64

3

system/IFC23.dll

windows10-2004-x64

3

system/IpDrv.dll

windows7-x64

3

system/IpDrv.dll

windows10-2004-x64

3

system/L2.exe

windows7-x64

3

system/L2.exe

windows10-2004-x64

3

system/Lin...re.dll

windows7-x64

3

system/Lin...re.dll

windows10-2004-x64

3

system/NSplash.dll

windows7-x64

3

system/NSplash.dll

windows10-2004-x64

3

system/dsetup.dll

windows7-x64

5

system/dsetup.dll

windows10-2004-x64

5

system/l2.exe

windows7-x64

3

system/l2.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    5ad8c2d12557a2f23262308d4e35c6a4_JaffaCakes118
  • Size 18.4MB
  • Sample241019-e38qrszamp
  • SHA256 e9eed41b62f5c45e591f6bbf4cfd3559907451159f020ce5a29c6bbca900851b
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
bootkitdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target
      system/ALAudio.dll
    • Size 147KB
    • SHA256 83a7dde1839ed8ec00b9b87e0a1772073a5f483c5ae09e92367905d7bed724c7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      system/Core.dll
    • Size 935KB
    • SHA256 9dd9b0019da6cdcc897f6e8af786a47ab79ad5a620c2b0ce8abe969c2cea2539
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      system/D3DDrv.dll
    • Size 1.4MB
    • SHA256 dc306e60d2ec100e613f307437e68df452248f79f26385eeaa5955e2e2a788ea
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      system/DefOpenAL32.dll
    • Size 112KB
    • SHA256 e433deb1edad3c16ef4b622c49ac89eb13f45b6cc022030e0a186fee0025af29
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      system/EncVag.dll
    • Size 147KB
    • SHA256 c888278386ad6f171af5db05ab9d892e103fedf5fefa2c859634bae3206620e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      system/Engine.dll
    • Size 25.4MB
    • SHA256 557c9f6d4f8bed1d517c38d9746d0b1895a440a32ce234f6e40067e6267efb24
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      system/FModeX.dll
    • Size 366KB
    • SHA256 dc5ab263fa9def8006e76fab4eb5d28e6c6d9bbe60e98602f8b53594b0dbfcfe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14
    • Target
      system/Fire.dll
    • Size 160KB
    • SHA256 5a13fc8c60cdfcd65dd351f9fcc4f5d7436709f1ac07c4c23148047554246d40
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      system/GameGuard.des
    • Size 1.2MB
    • SHA256 e7cf33d68392a408247cb024071509789e1b2515ce404b9bb2cb48de4ebd803c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    bootkitdiscoveryevasionpersistencetrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral17behavioral18
    • Target
      system/IFC23.DLL
    • Size 228KB
    • SHA256 2a4751b579ab8b68585d61dcef08fa6e9f5b853ce429b026e18a83ae1960fb1c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      system/IpDrv.dll
    • Size 296KB
    • SHA256 367c1458d6655d73cad7912693b307bd8cd0b2de11fba765164b70066b23fb5a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      system/L2.bin
    • Size 2.1MB
    • SHA256 f17f49bfeb2f8c5a8cb90bf4c5f407a96ed95ed69bdf5f16f2918f4220f0fe03
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      system/LineageCreature.dll
    • Size 114KB
    • SHA256 00ae9392c88ce14a364687a332fe9c3182e680138c99f690e84d6108a457857e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      system/NSplash.dll
    • Size 84KB
    • SHA256 3d10622b8081ea735461945e3810599aada57c02501b8e9f04be139e24341b83
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      system/dsetup.dll
    • Size 541KB
    • SHA256 e7aaffb852ce6103dcded9f000df220644de089aba2182751112f3bebfbd9271
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral29behavioral30
    • Target
      system/l2.exe
    • Size 515KB
    • SHA256 84f291194dc880cafe33e95c2b2f32da654460b7b9ef397e590d4d5b16fbc798
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discoveryupx
Score
5/10

behavioral14

discoveryupx
Score
5/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

bootkitdiscoveryevasionpersistencetrojan
Score
9/10

behavioral18

bootkitdiscoveryevasionpersistence
Score
9/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discoveryupx
Score
5/10

behavioral30

discoveryupx
Score
5/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10