Overview

overview

10

Static

static

1

JaffaCakes...92.exe

windows7-x64

10

JaffaCakes...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_e223f06b7cfce43b7f2ac00ed8efda1822f9d25070cbdff24194ad6e2c8ab692

  • Size

    709.8MB

  • Sample

    241230-yeb7faxrhz

  • MD5

    64de8d7575c3c3c77e4d2529158aae17

  • SHA1

    7cf77f38f42940c077ee965b07fd6b0a1841b448

  • SHA256

    e223f06b7cfce43b7f2ac00ed8efda1822f9d25070cbdff24194ad6e2c8ab692

  • SHA512

    d8d2f0da2b21c27f1d29d5e977648247b034c833089bc750830f22be2c2eefac1af9d6b335a74ef68ecd35fd722d30ac57b4b2ef9818c929259e892988d42044

  • SSDEEP

    98304:uaS3c+ri3ZCbzKZ3qT9ou71VyDb5RWuWC70b:uh31wZCbzKZweIIlRKC7

Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target

      JaffaCakes118_e223f06b7cfce43b7f2ac00ed8efda1822f9d25070cbdff24194ad6e2c8ab692

    • Size

      709.8MB

    • MD5

      64de8d7575c3c3c77e4d2529158aae17

    • SHA1

      7cf77f38f42940c077ee965b07fd6b0a1841b448

    • SHA256

      e223f06b7cfce43b7f2ac00ed8efda1822f9d25070cbdff24194ad6e2c8ab692

    • SHA512

      d8d2f0da2b21c27f1d29d5e977648247b034c833089bc750830f22be2c2eefac1af9d6b335a74ef68ecd35fd722d30ac57b4b2ef9818c929259e892988d42044

    • SSDEEP

      98304:uaS3c+ri3ZCbzKZ3qT9ou71VyDb5RWuWC70b:uh31wZCbzKZweIIlRKC7

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks