General

  • Target

    aadd0d2ba7a0e4ba9dc9ca9d16b3850a_JaffaCakes118

  • Size

    140KB

  • Sample

    241128-ecgjlazpgq

  • MD5

    aadd0d2ba7a0e4ba9dc9ca9d16b3850a

  • SHA1

    5b106ca81866f972f44bb715c11abaa0279545f8

  • SHA256

    69a57d048bdaf9d250af7a957072967829b945d66b1b4346a02ce723c4798095

  • SHA512

    d185d5225342be801847fc37c556ee2952a432418f861f1d1b7c7746e852af2ddb4479e6548b8312176c24fc97e5970a196409de5f5f8226e9e5054af75aa590

  • SSDEEP

    3072:5YnksSE64Ai6x1p2OrS4mOoQDgrz6xIuMBXrmqu:57Q6G0phr+ZQDgrW6B7mqu

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      aadd0d2ba7a0e4ba9dc9ca9d16b3850a_JaffaCakes118

    • Size

      140KB

    • MD5

      aadd0d2ba7a0e4ba9dc9ca9d16b3850a

    • SHA1

      5b106ca81866f972f44bb715c11abaa0279545f8

    • SHA256

      69a57d048bdaf9d250af7a957072967829b945d66b1b4346a02ce723c4798095

    • SHA512

      d185d5225342be801847fc37c556ee2952a432418f861f1d1b7c7746e852af2ddb4479e6548b8312176c24fc97e5970a196409de5f5f8226e9e5054af75aa590

    • SSDEEP

      3072:5YnksSE64Ai6x1p2OrS4mOoQDgrz6xIuMBXrmqu:57Q6G0phr+ZQDgrW6B7mqu

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks