General

  • Target

    JaffaCakes118_c64e42eab79cd6d485da1ab7f3bb110670a73fab56faa4584a7770fd299bb9a1

  • Size

    4.1MB

  • Sample

    241223-14e1qssre1

  • MD5

    ecaf09cfda63998fbe06812d5a60c551

  • SHA1

    f612d3909ffbbf9dad005732c33c865efd66ee32

  • SHA256

    c64e42eab79cd6d485da1ab7f3bb110670a73fab56faa4584a7770fd299bb9a1

  • SHA512

    30b97706bfbbd737ec726e46c14d6f40c29ea4ff37a3ef8e394339009b5bb44a38eae225d5a676dc243070cd59ae71a14da0c2e32cf9ce949ae4a3fa57e85c90

  • SSDEEP

    98304:rRoZaADHl6HvdrviNptDEFP3Um57GqVvuJ0:doc0lIFTgruEm57Gxi

Malware Config

Targets

    • Target

      JaffaCakes118_c64e42eab79cd6d485da1ab7f3bb110670a73fab56faa4584a7770fd299bb9a1

    • Size

      4.1MB

    • MD5

      ecaf09cfda63998fbe06812d5a60c551

    • SHA1

      f612d3909ffbbf9dad005732c33c865efd66ee32

    • SHA256

      c64e42eab79cd6d485da1ab7f3bb110670a73fab56faa4584a7770fd299bb9a1

    • SHA512

      30b97706bfbbd737ec726e46c14d6f40c29ea4ff37a3ef8e394339009b5bb44a38eae225d5a676dc243070cd59ae71a14da0c2e32cf9ce949ae4a3fa57e85c90

    • SSDEEP

      98304:rRoZaADHl6HvdrviNptDEFP3Um57GqVvuJ0:doc0lIFTgruEm57Gxi

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba family

    • Glupteba payload

    • Windows security bypass

    • Modifies Windows Firewall

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Modifies boot configuration data using bcdedit

MITRE ATT&CK Enterprise v15

Tasks