Overview

overview

10

Static

static

5

7927418bca...18.exe

windows7-x64

10

7927418bca...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7927418bcafbad559d3f8c797ed92f3d_JaffaCakes118

  • Size

    657KB

  • Sample

    241028-mgd82avkbz

  • MD5

    7927418bcafbad559d3f8c797ed92f3d

  • SHA1

    da32eb5e9388db9c14bf1e4dcc4fb3dd01b4465b

  • SHA256

    f73e7197dfe5928ba7c7d153c5daf947e559dec9f54d40d278d5ac728d46f360

  • SHA512

    3476344e363bc7aadd5676e4778ac2b433348dcebee500825eb2ac8dd558fd0448ce1c7e4b43ec3421564317da6def527e38087a286117b1a9a26d4cfc297dd6

  • SSDEEP

    12288:Hch76VXueiN6FcTElGm4ttxI+9Zumsvlpu0UvaGAlOBzZ1zssdwmeTvYy9Ue87vv:8t1f3o9G6+WTzZwAlOBzZ5dwmeTvYgUH

Score
10/10
bazaloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      7927418bcafbad559d3f8c797ed92f3d_JaffaCakes118

    • Size

      657KB

    • MD5

      7927418bcafbad559d3f8c797ed92f3d

    • SHA1

      da32eb5e9388db9c14bf1e4dcc4fb3dd01b4465b

    • SHA256

      f73e7197dfe5928ba7c7d153c5daf947e559dec9f54d40d278d5ac728d46f360

    • SHA512

      3476344e363bc7aadd5676e4778ac2b433348dcebee500825eb2ac8dd558fd0448ce1c7e4b43ec3421564317da6def527e38087a286117b1a9a26d4cfc297dd6

    • SSDEEP

      12288:Hch76VXueiN6FcTElGm4ttxI+9Zumsvlpu0UvaGAlOBzZ1zssdwmeTvYy9Ue87vv:8t1f3o9G6+WTzZwAlOBzZ5dwmeTvYgUH

    Score
    10/10
    bazaloaderdiscoverypersistencetrojanupx

    • Bazaloader family

      bazaloader

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.

      trojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks