General
-
Target
df2a5f4a1c2520b47344f9381e35b1cd_JaffaCakes118
-
Size
6.8MB
-
Sample
241211-av5lxs1pgk
-
MD5
df2a5f4a1c2520b47344f9381e35b1cd
-
SHA1
f7624e84e37211390eae2f724f63ab673b9b81c0
-
SHA256
ed4e0a839502edf88f6eb9832af5cab7262bf0bf2b85d198bd0cc0ccba1d1a82
-
SHA512
497268650204f900c81a198d1b3d8a30c9c2a46a0d56af82c81ff0c0088fee2b5dcfbb81b063dd38d4f7527848bd8be347fa4a870c237042f0de18d0e93c40c2
-
SSDEEP
49152:67N1ahC+0V7N1ahCu0V7N1ahCb0V7N1ahCh0V7N1ahCC7N1ahCy0V7N1ahCD0V79:67r7b7O7U7C7f727/7S7a
Malware Config
Targets
-
-
Target
df2a5f4a1c2520b47344f9381e35b1cd_JaffaCakes118
-
Size
6.8MB
-
MD5
df2a5f4a1c2520b47344f9381e35b1cd
-
SHA1
f7624e84e37211390eae2f724f63ab673b9b81c0
-
SHA256
ed4e0a839502edf88f6eb9832af5cab7262bf0bf2b85d198bd0cc0ccba1d1a82
-
SHA512
497268650204f900c81a198d1b3d8a30c9c2a46a0d56af82c81ff0c0088fee2b5dcfbb81b063dd38d4f7527848bd8be347fa4a870c237042f0de18d0e93c40c2
-
SSDEEP
49152:67N1ahC+0V7N1ahCu0V7N1ahCb0V7N1ahCh0V7N1ahCC7N1ahCy0V7N1ahCD0V79:67r7b7O7U7C7f727/7S7a
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
Fakeav family
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1