General

  • Target

    b13605766b48d2d4cadea70a5656189a_JaffaCakes118

  • Size

    73KB

  • Sample

    241129-pkdssazlgp

  • MD5

    b13605766b48d2d4cadea70a5656189a

  • SHA1

    67033dbdbacd9701f02951e4fe20dc80c203273c

  • SHA256

    21020225a6264c72c8b75eb76f998a40dd37f722e7276d512fb1a57e92c9063f

  • SHA512

    529d29434e80f038beb2863f9a047d37e10aa03ea9c6e2cac55ad21c85be7f8d8bf33dcccb45a78a77f03bd4da4ad04ed2a6ee02b093010776893f4ae535f722

  • SSDEEP

    1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRB:KCaZ2Yrb0VTXJYWEsCGuiv

Malware Config

Targets

    • Target

      b13605766b48d2d4cadea70a5656189a_JaffaCakes118

    • Size

      73KB

    • MD5

      b13605766b48d2d4cadea70a5656189a

    • SHA1

      67033dbdbacd9701f02951e4fe20dc80c203273c

    • SHA256

      21020225a6264c72c8b75eb76f998a40dd37f722e7276d512fb1a57e92c9063f

    • SHA512

      529d29434e80f038beb2863f9a047d37e10aa03ea9c6e2cac55ad21c85be7f8d8bf33dcccb45a78a77f03bd4da4ad04ed2a6ee02b093010776893f4ae535f722

    • SSDEEP

      1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRB:KCaZ2Yrb0VTXJYWEsCGuiv

    • Banload

      Banload variants download malicious files, then install and execute the files.

    • Banload family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks