Overview

overview

10

Static

static

1

JaffaCakes...23.exe

windows7-x64

10

JaffaCakes...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0f170f04c03a6aeb1b60fc29b053fcc981de9229f0aa60ddf7988d3bb3167c23

  • Size

    2.1MB

  • Sample

    241225-f6ahtayrfr

  • MD5

    fe5b9802204418aa5238c4d2a16d799c

  • SHA1

    eaf47425d900150ceb5f0e88e5e7d08e4634bb20

  • SHA256

    0f170f04c03a6aeb1b60fc29b053fcc981de9229f0aa60ddf7988d3bb3167c23

  • SHA512

    98d6aa61d479adec304b63b9fb07e611767f7f27d3fb2cf267895264100d6d2c4cde92803be9a9216990df9962ebdf84eb39986da7115b36742837300e14707d

  • SSDEEP

    49152:/RmS6Vx3F1rSdZ/ufvr7TE22qqpE+OVbbI3TyqxNoJ4vhxPXSn:/RTy3PWd9ufD+B07rJYLE

Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target

      JaffaCakes118_0f170f04c03a6aeb1b60fc29b053fcc981de9229f0aa60ddf7988d3bb3167c23

    • Size

      2.1MB

    • MD5

      fe5b9802204418aa5238c4d2a16d799c

    • SHA1

      eaf47425d900150ceb5f0e88e5e7d08e4634bb20

    • SHA256

      0f170f04c03a6aeb1b60fc29b053fcc981de9229f0aa60ddf7988d3bb3167c23

    • SHA512

      98d6aa61d479adec304b63b9fb07e611767f7f27d3fb2cf267895264100d6d2c4cde92803be9a9216990df9962ebdf84eb39986da7115b36742837300e14707d

    • SSDEEP

      49152:/RmS6Vx3F1rSdZ/ufvr7TE22qqpE+OVbbI3TyqxNoJ4vhxPXSn:/RTy3PWd9ufD+B07rJYLE

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks