irata | JaffaCakes118_3dd4a15e294cf37e21f67602f18a69fa3b82078bb74498a9a3c29741f5dc820b

General

Target
JaffaCakes118_3dd4a15e294cf37e21f67602f18a69fa3b82078bb74498a9a3c29741f5dc820b
Size 717.3MB
Sample241230-b7bp2stnav
SHA256 3dd4a15e294cf37e21f67602f18a69fa3b82078bb74498a9a3c29741f5dc820b
MD5 42e9cd8900f0ecc8dc2d940b5cdb35de
SHA1 54bf137b20ee4d2209b28ac0e448ed30813e460f
SHA512 ad8096bfd55d3f355149f0966110b8f0eb89f59487d29602b8ce9512520d5fffb6a225560702d001e256bb1b3d6ca53c07154b4275b178ac8a67ae7fd91d5a7b
SSDEEP 6291456:eEkyLQESHyMEYGlYdRjlzoeawQigGBQRdbPs32:eELQgM0l6jlcPbW2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

irata privateloader

Malware Config

Signatures

Irata family
irata

Irata payload 1 IoCs

resource	yara_rule
sample	family_irata4

Privateloader family
privateloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_3dd4a15e294cf37e21f67602f18a69fa3b82078bb74498a9a3c29741f5dc820b

File Explorer

JaffaCakes118_3dd4a15e294cf37e21f67602f18a69fa3b82078bb74498a9a3c29741f5dc820b

.exe 717.3MB

JaffaCakes118_3dd4a15e294cf37e21f67602f18a69fa3b82078bb74498a9a3c29741f5dc820b

IMPHASH 7e34df381f2f945918bb7d0930affcbc
SHA256 3dd4a15e294cf37e21f67602f18a69fa3b82078bb74498a9a3c29741f5dc820b
MD5 42e9cd8900f0ecc8dc2d940b5cdb35de
SHA1 54bf137b20ee4d2209b28ac0e448ed30813e460f
SHA512 ad8096bfd55d3f355149f0966110b8f0eb89f59487d29602b8ce9512520d5fffb6a225560702d001e256bb1b3d6ca53c07154b4275b178ac8a67ae7fd91d5a7b
SSDEEP 6291456:eEkyLQESHyMEYGlYdRjlzoeawQigGBQRdbPs32:eELQgM0l6jlcPbW2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Irata payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\build\ob\bora-17340778\vos3\thinstall\modules\boot_loader64.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc WriteFile LeaveCriticalSection EnterCriticalSection HeapSize GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsProcessorFeaturePresent IsDebuggerPresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree LoadLibraryExW

user32

wsprintfW MessageBoxW

ntdll

RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlCreateAcl RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess NtQueryInformationProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtClearEvent LdrUnloadDll LdrLoadDll NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtOpenSection NtWriteVirtualMemory NtUnmapViewOfSection NtClose RtlNtStatusToDosError NtProtectVirtualMemory NtCreateEvent RtlAddAccessAllowedAce

Sharing