Overview

overview

10

Static

static

3

JaffaCakes...53.exe

windows7-x64

3

JaffaCakes...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_fc542972fb9da1997a2c9192aa75fbe3fda4213c514ccfd8aab031d0e73e1653

  • Size

    168KB

  • Sample

    241223-z8w95s1rhl

  • MD5

    d14f6006092df0f6cbab4a63dc311e87

  • SHA1

    091a3eed5d7b051decbab251ac9c1cdc51391012

  • SHA256

    fc542972fb9da1997a2c9192aa75fbe3fda4213c514ccfd8aab031d0e73e1653

  • SHA512

    49b88e2f71ccf3e32c0660074a9adbb0b3bc8a15d792276a275949e00f6aeaab336f327cd9114e1387c42c558a06dcb0afb73a7195dfdb91d909d38a8d127bc0

  • SSDEEP

    3072:qmtFcde+TnU2dv/0OE3RfmZ8KtPEGP+D6THectFc:btKde6nvxsfmGKP2CectK

Score
10/10
guloaderdiscoverydownloaderpersistence

Malware Config

Targets

    • Target

      JaffaCakes118_fc542972fb9da1997a2c9192aa75fbe3fda4213c514ccfd8aab031d0e73e1653

    • Size

      168KB

    • MD5

      d14f6006092df0f6cbab4a63dc311e87

    • SHA1

      091a3eed5d7b051decbab251ac9c1cdc51391012

    • SHA256

      fc542972fb9da1997a2c9192aa75fbe3fda4213c514ccfd8aab031d0e73e1653

    • SHA512

      49b88e2f71ccf3e32c0660074a9adbb0b3bc8a15d792276a275949e00f6aeaab336f327cd9114e1387c42c558a06dcb0afb73a7195dfdb91d909d38a8d127bc0

    • SSDEEP

      3072:qmtFcde+TnU2dv/0OE3RfmZ8KtPEGP+D6THectFc:btKde6nvxsfmGKP2CectK

    Score
    10/10
    discoveryguloaderdownloaderpersistence

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks