vobfus | 60991663d14ad6c7905823301bdfc67ef632e37046db82acbfda4a91c7364484 | Triage

Submit
Reports

Overview

overview

Static

static

5

JaffaCakes...b5.exe

windows7-x64

JaffaCakes...b5.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_21abada9dc9df14aee6ab9f7dd9ab6b5
Size

3.6MB
Sample

241231-rsdh4avjaz
MD5

21abada9dc9df14aee6ab9f7dd9ab6b5
SHA1

cc58c6c78bb3c2eaafa7a7a1d26c1c8fc610ff6d
SHA256

60991663d14ad6c7905823301bdfc67ef632e37046db82acbfda4a91c7364484
SHA512

17f1831702ace1d19781231678328b5d092d5c0863e174cc46fcdb877adf9067132498470c999682a449abea2b9fea3bedc3185e4f5b11c9f3c8f4f3e8c9d697
SSDEEP

98304:Vbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb5:v

Score

10^/10

vobfus discovery persistence upx worm

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_21abada9dc9df14aee6ab9f7dd9ab6b5.exe

Resource

win7-20240903-en

vobfus discovery persistence upx worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_21abada9dc9df14aee6ab9f7dd9ab6b5.exe

Resource

win10v2004-20241007-en

vobfus discovery persistence upx worm

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_21abada9dc9df14aee6ab9f7dd9ab6b5
- Size
  
  3.6MB
- MD5
  
  21abada9dc9df14aee6ab9f7dd9ab6b5
- SHA1
  
  cc58c6c78bb3c2eaafa7a7a1d26c1c8fc610ff6d
- SHA256
  
  60991663d14ad6c7905823301bdfc67ef632e37046db82acbfda4a91c7364484
- SHA512
  
  17f1831702ace1d19781231678328b5d092d5c0863e174cc46fcdb877adf9067132498470c999682a449abea2b9fea3bedc3185e4f5b11c9f3c8f4f3e8c9d697
- SSDEEP
  
  98304:Vbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb5:v
Score

10^/10

vobfus discovery persistence upx worm
- Vobfus
  A widespread worm which spreads via network drives and removable media.
  worm vobfus
- Vobfus family
  vobfus
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vobfusdiscoverypersistenceupxworm

behavioral2

vobfusdiscoverypersistenceupxworm

© 2018-2025

Terms | Privacy