General

  • Target

    JaffaCakes118_a16fd5aa514019f1a5eebb1bf46cebb3ce660fd280df00263e43a1051f30daaf

  • Size

    4.1MB

  • Sample

    241225-s9vdlsxlay

  • MD5

    3122fdf28594fbdcf46f8d9cb627daef

  • SHA1

    7c4659d163c87999a31315d5f6f4f69d295e84ca

  • SHA256

    a16fd5aa514019f1a5eebb1bf46cebb3ce660fd280df00263e43a1051f30daaf

  • SHA512

    06a718b35c52a387a85761dc92756b25d915c3acfe0b39951dcc4c9fd72bf372f1bce84bb8c624dbe5a21ced7416afe5af2de7052f598c9d70738fb0975f2963

  • SSDEEP

    98304:B93+azEjbwULrHtUTkkZPNeSFfkFrMjEBSBhpRsuTSHBK:dEjbwe7tYXZAYWhgTsg8K

Malware Config

Targets

    • Target

      JaffaCakes118_a16fd5aa514019f1a5eebb1bf46cebb3ce660fd280df00263e43a1051f30daaf

    • Size

      4.1MB

    • MD5

      3122fdf28594fbdcf46f8d9cb627daef

    • SHA1

      7c4659d163c87999a31315d5f6f4f69d295e84ca

    • SHA256

      a16fd5aa514019f1a5eebb1bf46cebb3ce660fd280df00263e43a1051f30daaf

    • SHA512

      06a718b35c52a387a85761dc92756b25d915c3acfe0b39951dcc4c9fd72bf372f1bce84bb8c624dbe5a21ced7416afe5af2de7052f598c9d70738fb0975f2963

    • SSDEEP

      98304:B93+azEjbwULrHtUTkkZPNeSFfkFrMjEBSBhpRsuTSHBK:dEjbwe7tYXZAYWhgTsg8K

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba family

    • Glupteba payload

    • Windows security bypass

    • Modifies boot configuration data using bcdedit

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.