Overview

overview

10

Static

static

7

JaffaCakes...06.exe

windows7-x64

10

JaffaCakes...06.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_98403eafbcf101d85e2430a16faf3706

  • Size

    2.3MB

  • Sample

    250105-kk3dxsypay

  • MD5

    98403eafbcf101d85e2430a16faf3706

  • SHA1

    4380ed76f1db7b5d5005be007d22e45cd43c76a5

  • SHA256

    d678b4a46d5a6ce2563bbb9875615d73e4d81a09163db2a8c81070552d395d2d

  • SHA512

    db2c29e1605e3b1d49677ddc2ab1769935a1cb7a773dc92b6da42ac50ae9c389944d7a9a80d05e16c9b1b6205fbd71c96eba409baee7ebe6d0367469a62a51a6

  • SSDEEP

    49152:H4K8kzHnk6T+Mt56XeZ9+22/iWv6TkOQA46+WWOdIDKblWWKaRtll5qH:H4K84tnSx2QPzFWBWDKxJKytl7y

Score
10/10
sectopratdiscoveryevasionratthemidatrojan

Malware Config

Targets

    • Target

      JaffaCakes118_98403eafbcf101d85e2430a16faf3706

    • Size

      2.3MB

    • MD5

      98403eafbcf101d85e2430a16faf3706

    • SHA1

      4380ed76f1db7b5d5005be007d22e45cd43c76a5

    • SHA256

      d678b4a46d5a6ce2563bbb9875615d73e4d81a09163db2a8c81070552d395d2d

    • SHA512

      db2c29e1605e3b1d49677ddc2ab1769935a1cb7a773dc92b6da42ac50ae9c389944d7a9a80d05e16c9b1b6205fbd71c96eba409baee7ebe6d0367469a62a51a6

    • SSDEEP

      49152:H4K8kzHnk6T+Mt56XeZ9+22/iWv6TkOQA46+WWOdIDKblWWKaRtll5qH:H4K84tnSx2QPzFWBWDKxJKytl7y

    Score
    10/10
    sectopratdiscoveryevasionratthemidatrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks