vobfus | 1b9381edd94145370329e0a82d48608eccf4202c65666a733b916caa603ed56c | Triage

Submit
Reports

Overview

overview

Static

static

3

5fecb710dd...18.exe

windows7-x64

3

5fecb710dd...18.exe

windows10-2004-x64

Sharing

General

Target

5fecb710ddc8f6c144a2c6e56cb763a9_JaffaCakes118
Size

152KB
Sample

241020-cyw53atele
MD5

5fecb710ddc8f6c144a2c6e56cb763a9
SHA1

8dcf4c9e9b67f3b25dac847c18dc01c96578e99c
SHA256

1b9381edd94145370329e0a82d48608eccf4202c65666a733b916caa603ed56c
SHA512

273a7f5403754b2aebb06145110a0821efd2b8f78792b1430583fd7773bfbbbc6103e5fb5f29239acf213eb5506e3003d8dd151c7c101477405be537cf19c219
SSDEEP

1536:LaHq107vAVltkQo3T2k9/btav2v4rEq1/0SdJxq5gbnvluQDPwnEy3OcoeFFuTnU:Lejtav24r58SdJxbkn/jMTnU

Score

10^/10

vobfus discovery persistence upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5fecb710ddc8f6c144a2c6e56cb763a9_JaffaCakes118.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

5fecb710ddc8f6c144a2c6e56cb763a9_JaffaCakes118.exe

Resource

win10v2004-20241007-en

vobfus discovery persistence upx worm

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  5fecb710ddc8f6c144a2c6e56cb763a9_JaffaCakes118
- Size
  
  152KB
- MD5
  
  5fecb710ddc8f6c144a2c6e56cb763a9
- SHA1
  
  8dcf4c9e9b67f3b25dac847c18dc01c96578e99c
- SHA256
  
  1b9381edd94145370329e0a82d48608eccf4202c65666a733b916caa603ed56c
- SHA512
  
  273a7f5403754b2aebb06145110a0821efd2b8f78792b1430583fd7773bfbbbc6103e5fb5f29239acf213eb5506e3003d8dd151c7c101477405be537cf19c219
- SSDEEP
  
  1536:LaHq107vAVltkQo3T2k9/btav2v4rEq1/0SdJxq5gbnvluQDPwnEy3OcoeFFuTnU:Lejtav24r58SdJxbkn/jMTnU
Score

10^/10

discovery vobfus persistence upx worm
- Vobfus
  A widespread worm which spreads via network drives and removable media.
  worm vobfus
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

vobfusdiscoverypersistenceupxworm

© 2018-2025

Terms | Privacy