General

  • Target

    9246ed3f080a5b1ffb18cf72f1cd6ea9_JaffaCakes118

  • Size

    155KB

  • Sample

    241124-dxaq4s1qgy

  • MD5

    9246ed3f080a5b1ffb18cf72f1cd6ea9

  • SHA1

    04d6d08a2ba9fa7268e8f7d3c3779052b4d61754

  • SHA256

    c5631bed2b3c9c899d5ed9176f4d69444bd354d6ef311eeefa18fae1d8be99a3

  • SHA512

    cd686c5a15e033ff8389c950dfdbe55a4fc28d4547af339b363699cd572d910e3162d2b36190ea98e576553e7e32429099cf3c5556f0dab2094b9e8ffa20d782

  • SSDEEP

    3072:PfVskFgAFay1Gt9xPUKWUCfTYxSzzdniHlcbLHm7C:PNskFPFaaGtDMv9fnzhniHGby7C

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      9246ed3f080a5b1ffb18cf72f1cd6ea9_JaffaCakes118

    • Size

      155KB

    • MD5

      9246ed3f080a5b1ffb18cf72f1cd6ea9

    • SHA1

      04d6d08a2ba9fa7268e8f7d3c3779052b4d61754

    • SHA256

      c5631bed2b3c9c899d5ed9176f4d69444bd354d6ef311eeefa18fae1d8be99a3

    • SHA512

      cd686c5a15e033ff8389c950dfdbe55a4fc28d4547af339b363699cd572d910e3162d2b36190ea98e576553e7e32429099cf3c5556f0dab2094b9e8ffa20d782

    • SSDEEP

      3072:PfVskFgAFay1Gt9xPUKWUCfTYxSzzdniHlcbLHm7C:PNskFPFaaGtDMv9fnzhniHGby7C

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks