General

  • Target

    e5016756e3139fa7330624c36c1edcca_JaffaCakes118

  • Size

    278KB

  • Sample

    241212-gnm7maxjgj

  • MD5

    e5016756e3139fa7330624c36c1edcca

  • SHA1

    439c457f3701c846423013d49153a7e704110c53

  • SHA256

    c03b80337ebbcce27ca5110c71dbdf657d23bd7b33e67ae6600759d835d0316d

  • SHA512

    804f3e6a2988c9616af78d72a2dd61808f1b6bb3b775187fe97b0768b142f4d990e0617ac71d627d23597a429693529ef65d0b6c7112ece0a9a3d863c6b9709a

  • SSDEEP

    6144:ioq1J1l9YwoFib90Bp+3wHUAfw9Fgcuy2wq8B7H4wF:ivnkiRYp+gHA9FghTaH7F

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      e5016756e3139fa7330624c36c1edcca_JaffaCakes118

    • Size

      278KB

    • MD5

      e5016756e3139fa7330624c36c1edcca

    • SHA1

      439c457f3701c846423013d49153a7e704110c53

    • SHA256

      c03b80337ebbcce27ca5110c71dbdf657d23bd7b33e67ae6600759d835d0316d

    • SHA512

      804f3e6a2988c9616af78d72a2dd61808f1b6bb3b775187fe97b0768b142f4d990e0617ac71d627d23597a429693529ef65d0b6c7112ece0a9a3d863c6b9709a

    • SSDEEP

      6144:ioq1J1l9YwoFib90Bp+3wHUAfw9Fgcuy2wq8B7H4wF:ivnkiRYp+gHA9FghTaH7F

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks