General

  • Target

    dd0113a0d746e31319f3bda95311d746_JaffaCakes118

  • Size

    108KB

  • Sample

    241210-e3f1raynap

  • MD5

    dd0113a0d746e31319f3bda95311d746

  • SHA1

    2a63115068ed141d95c8152aa17831489eb3bed4

  • SHA256

    12565977dcb81ce55537c44bc667a4ca7a2e39c9ea08f0e6bd83d00957b4d7af

  • SHA512

    14ca7feb93db28b06348bc50402ef3d40108c9ade62d07181ce7c1a29684e8ec6809742a388d3f42d82c1a94bd0fcb1fd631b950bee3b5ef3387f09e63c27871

  • SSDEEP

    1536:AaN+jC5j24p0ysKJM51nwdMLHc5poWEiW5i6uEjtwn64pVEDLbxbTSF:nR2yhmnwu+7W5xuE2XcbRWF

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      dd0113a0d746e31319f3bda95311d746_JaffaCakes118

    • Size

      108KB

    • MD5

      dd0113a0d746e31319f3bda95311d746

    • SHA1

      2a63115068ed141d95c8152aa17831489eb3bed4

    • SHA256

      12565977dcb81ce55537c44bc667a4ca7a2e39c9ea08f0e6bd83d00957b4d7af

    • SHA512

      14ca7feb93db28b06348bc50402ef3d40108c9ade62d07181ce7c1a29684e8ec6809742a388d3f42d82c1a94bd0fcb1fd631b950bee3b5ef3387f09e63c27871

    • SSDEEP

      1536:AaN+jC5j24p0ysKJM51nwdMLHc5poWEiW5i6uEjtwn64pVEDLbxbTSF:nR2yhmnwu+7W5xuE2XcbRWF

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks