vobfus | a6ef6f6c2903431580bdd87e3aa3ee4fdd1f33b3a533a72ff735185e3d32ad9c | Triage

Submit
Reports

Overview

overview

Static

static

3

87d9ef97da...18.exe

windows7-x64

87d9ef97da...18.exe

windows10-2004-x64

Sharing

General

Target

87d9ef97da1e685c852a13caa06d07fb_JaffaCakes118
Size

95KB
Sample

241102-1a1qcavrc1
MD5

87d9ef97da1e685c852a13caa06d07fb
SHA1

96721e8bc666588b9f2b1adc01f13d566157a989
SHA256

a6ef6f6c2903431580bdd87e3aa3ee4fdd1f33b3a533a72ff735185e3d32ad9c
SHA512

ab10ed5236fa6ded2d1d595c8fbca9a552aa05bb289ecd0d87149a7f852bff438d5fe8a6007230e6b4002c5e1839c91e44f9406e60fa7337eecf9dc1cc7212ad
SSDEEP

1536:fN8k3qSADi1D5z8HqyA8vk0mRW2abvrRt5Cmxvxi2XB8fgHR29Z15zFvUprX:d1ADKD5ADMrRALk6xiVfgxWZPzFST

Score

10^/10

vobfus discovery persistence upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

87d9ef97da1e685c852a13caa06d07fb_JaffaCakes118.exe

Resource

win7-20241010-en

vobfus discovery persistence upx worm

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

87d9ef97da1e685c852a13caa06d07fb_JaffaCakes118.exe

Resource

win10v2004-20241007-en

vobfus discovery persistence upx worm

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  87d9ef97da1e685c852a13caa06d07fb_JaffaCakes118
- Size
  
  95KB
- MD5
  
  87d9ef97da1e685c852a13caa06d07fb
- SHA1
  
  96721e8bc666588b9f2b1adc01f13d566157a989
- SHA256
  
  a6ef6f6c2903431580bdd87e3aa3ee4fdd1f33b3a533a72ff735185e3d32ad9c
- SHA512
  
  ab10ed5236fa6ded2d1d595c8fbca9a552aa05bb289ecd0d87149a7f852bff438d5fe8a6007230e6b4002c5e1839c91e44f9406e60fa7337eecf9dc1cc7212ad
- SSDEEP
  
  1536:fN8k3qSADi1D5z8HqyA8vk0mRW2abvrRt5Cmxvxi2XB8fgHR29Z15zFvUprX:d1ADKD5ADMrRALk6xiVfgxWZPzFST
Score

10^/10

vobfus discovery persistence upx worm
- Vobfus
  A widespread worm which spreads via network drives and removable media.
  worm vobfus
- Vobfus family
  vobfus
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vobfusdiscoverypersistenceupxworm

behavioral2

vobfusdiscoverypersistenceupxworm

© 2018-2025

Terms | Privacy