General

  • Target

    8e4dc96dc37e0c882500ecd0983f05fe_JaffaCakes118

  • Size

    73KB

  • Sample

    241104-a2h2ha1qam

  • MD5

    8e4dc96dc37e0c882500ecd0983f05fe

  • SHA1

    c467a8399c92e0d8ff73f7bad9ea1194cae903d0

  • SHA256

    b4e5c71440c20850e73fbb8e70bb2a8b1c69ba06433f5010ef036361edace8b3

  • SHA512

    4f930ad43d9bcfb6a0a01d7d1d31b059e0eb5d23be2934636abd65a673020200a9afc0a43c46e9af6d1406403543b7c445dbbefb310f149fdbc755f8e3debfeb

  • SSDEEP

    1536:yCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRO:yCaZ2Yrb0VTXJYWEsCGuiU

Malware Config

Targets

    • Target

      8e4dc96dc37e0c882500ecd0983f05fe_JaffaCakes118

    • Size

      73KB

    • MD5

      8e4dc96dc37e0c882500ecd0983f05fe

    • SHA1

      c467a8399c92e0d8ff73f7bad9ea1194cae903d0

    • SHA256

      b4e5c71440c20850e73fbb8e70bb2a8b1c69ba06433f5010ef036361edace8b3

    • SHA512

      4f930ad43d9bcfb6a0a01d7d1d31b059e0eb5d23be2934636abd65a673020200a9afc0a43c46e9af6d1406403543b7c445dbbefb310f149fdbc755f8e3debfeb

    • SSDEEP

      1536:yCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRO:yCaZ2Yrb0VTXJYWEsCGuiU

    • Banload

      Banload variants download malicious files, then install and execute the files.

    • Banload family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks