General

  • Target

    ab173272716473a22f8da11e085c1add_JaffaCakes118

  • Size

    128KB

  • Sample

    241128-frmvlawqbx

  • MD5

    ab173272716473a22f8da11e085c1add

  • SHA1

    1598bcbce44a7645ef9094f0e3fcaa03a5e839bf

  • SHA256

    9acdb9b3c06b2c8e7fa16509553d842a240e1f9cdd99c43c482397f1d38bdef7

  • SHA512

    42eea9882abb9f12fe7141e6675f5a74bb02614d86edc915200af8b5603ab982a36da5a26a45fca83693958a71e7efaac0434f4a40367122f89ba27ed0ea878c

  • SSDEEP

    3072:8Z2xvc3PcSnZ1p+vSy4igMBZeV2GhAhI5a6iCL2Uh:9xU3P7Z14vSVi5eV2hIjKk

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      ab173272716473a22f8da11e085c1add_JaffaCakes118

    • Size

      128KB

    • MD5

      ab173272716473a22f8da11e085c1add

    • SHA1

      1598bcbce44a7645ef9094f0e3fcaa03a5e839bf

    • SHA256

      9acdb9b3c06b2c8e7fa16509553d842a240e1f9cdd99c43c482397f1d38bdef7

    • SHA512

      42eea9882abb9f12fe7141e6675f5a74bb02614d86edc915200af8b5603ab982a36da5a26a45fca83693958a71e7efaac0434f4a40367122f89ba27ed0ea878c

    • SSDEEP

      3072:8Z2xvc3PcSnZ1p+vSy4igMBZeV2GhAhI5a6iCL2Uh:9xU3P7Z14vSVi5eV2hIjKk

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks