General

  • Target

    JaffaCakes118_1af039b45840346b46a0552781a6fcc4e53262ceb0297e743a331d37ae402434

  • Size

    10.2MB

  • MD5

    8ae98d71bf3ec91314feb236a97ebf47

  • SHA1

    52f1ef5e81f8ff37717c046716cefddaffde460f

  • SHA256

    1af039b45840346b46a0552781a6fcc4e53262ceb0297e743a331d37ae402434

  • SHA512

    e938723636104b7813a4fde97c32225b6c250d2d7c38882be55ad8ead81e6bf86e53a9cd81a7a8b3ae2f79691be3dae8923cf74d8aa952c194631d98fce1167b

  • SSDEEP

    196608:B/uSml8bv4NhBUSJC/FK1FvgoBgpvidvKr6phW0lFso5M66AWFt8Wn0uoTfgb4A:BWSmlgv2hBUKqK1MpqdW6OeFso5d29+4

Malware Config

Extracted

Family

socelars

C2

https://sa-us-bucket.s3.us-east-2.amazonaws.com/jhvre24/

Extracted

Family

nullmixer

C2

http://623f4ec578a9a.com/

Signatures

  • Nullmixer family
  • Socelars family
  • Socelars payload 1 IoCs
  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 18 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_1af039b45840346b46a0552781a6fcc4e53262ceb0297e743a331d37ae402434
    .zip
  • 7zS8B74BEBB/623f4ec66a5ad_Sat1734f544217.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 7zS8B74BEBB/623f4ec77fd3f_Sat1772aefb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/623f4ec86395b_Sat173c84b551.exe
    .exe windows:4 windows x86 arch:x86

    d852170d3e7e3c3799ee190d06d276c3


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/623f4eca3de95_Sat17334d36c.exe
    .exe windows:6 windows x86 arch:x86

    5a594319a0d69dbc452e748bcf05892e


    Headers

    Imports

    Exports

    Sections

  • 7zS8B74BEBB/623f4ecc3aad7_Sat17f86f68979.exe
    .exe windows:5 windows x86 arch:x86

    487134aabf70de91adaa596b972e9646


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/623f4ecdc319c_Sat17f45527bef2.exe
    .exe windows:5 windows x86 arch:x86

    b4070734502a100c8f90bbd445995533


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/623f4ee48c005_Sat17a6fc071121.exe
    .exe windows:5 windows x86 arch:x86

    f84c6b8ca58d51fa74cec891420e31aa


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/623f4ee614d64_Sat17bf153ed.exe
    .exe windows:6 windows x64 arch:x64

    bb46f1abb2c1ede95f964a725f9d1284


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/623f4ee7540ef_Sat1772b105d2a.exe
    .exe windows:5 windows x86 arch:x86

    487134aabf70de91adaa596b972e9646


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/623f4ee864d35_Sat17400b6f.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 7zS8B74BEBB/623f4ee97f2a0_Sat170aca8c6fbd.exe
    .exe windows:6 windows x86 arch:x86

    9bee8199b5b5073088f87efddf7d7866


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/623f4eeb25e05_Sat1728a2b93.exe
    .exe windows:6 windows x86 arch:x86

    d69e4c13e25f0ad622344ac56118c0df


    Headers

    Imports

    Sections

  • 7zS8B74BEBB/libcurl.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 7zS8B74BEBB/libcurlpp.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 7zS8B74BEBB/libgcc_s_dw2-1.dll
    .dll windows:4 windows x86 arch:x86

    04f9a5136edc374e78bc81dc8b0d07af


    Headers

    Imports

    Exports

    Sections

  • 7zS8B74BEBB/libstdc++-6.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 7zS8B74BEBB/libwinpthread-1.dll
    .dll windows:4 windows x86 arch:x86

    fc24104becbbff1210c7fd71e49c8b5f


    Headers

    Imports

    Exports

    Sections

  • 7zS8B74BEBB/setup_install.exe
    .exe windows:4 windows x86 arch:x86

    f9fc0ecba4bcf3f4eadacd9b358488bc


    Headers

    Imports

    Sections