General

  • Target

    c65aaf6e49e405519870b1c2d37217a6_JaffaCakes118

  • Size

    42KB

  • Sample

    241205-g9ahnasnhw

  • MD5

    c65aaf6e49e405519870b1c2d37217a6

  • SHA1

    a2da3d0298ce9edc1373870bc37103d254149440

  • SHA256

    82bc8558473813877be64b53f1bf24bbaee80a6cadd76b270f0e1ee79a2d01a4

  • SHA512

    783d018d70167d7320a046a17e7202a7168f021e647be0fbbafbe3e823342cf9da0aa5012fe90aa4c911a4a89c140829af88665ec5aef93927e2b8cca0c6b206

  • SSDEEP

    768:0uCkdC2D5z4oWV0OCAB4Rld8Inv47pw766fsj:0jkdjl8WK4RP84vk266

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      c65aaf6e49e405519870b1c2d37217a6_JaffaCakes118

    • Size

      42KB

    • MD5

      c65aaf6e49e405519870b1c2d37217a6

    • SHA1

      a2da3d0298ce9edc1373870bc37103d254149440

    • SHA256

      82bc8558473813877be64b53f1bf24bbaee80a6cadd76b270f0e1ee79a2d01a4

    • SHA512

      783d018d70167d7320a046a17e7202a7168f021e647be0fbbafbe3e823342cf9da0aa5012fe90aa4c911a4a89c140829af88665ec5aef93927e2b8cca0c6b206

    • SSDEEP

      768:0uCkdC2D5z4oWV0OCAB4Rld8Inv47pw766fsj:0jkdjl8WK4RP84vk266

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks