Overview

overview

10

Static

static

7

JaffaCakes...a0.exe

windows7-x64

10

JaffaCakes...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b72f01503f93119443cc9cb1a96561a0

  • Size

    2.3MB

  • Sample

    250105-xasg7asmc1

  • MD5

    b72f01503f93119443cc9cb1a96561a0

  • SHA1

    27e60439abacc18c1cca680fbf54b3d0e945a18a

  • SHA256

    05cd69760b7358e9f1d06a077bcac5776e788e6d3c2af917f1aa8bebe16d8b7a

  • SHA512

    8e0bf201f59a5a5b8ac019060100327db1e1daa64d256c41b6dc87abe5f6a1b2679ac3bd87e6c6fd95af0e50e315b0055fe537f1ad66346dce6652ba4e0014b0

  • SSDEEP

    49152:izCjo6k0aWbdhmvwoy+cAd314kpT3Kf8BfiUy6NN5gc:Po/AdhKwoyNI31v3FBfinmN5gc

Score
10/10
sectopratdiscoveryevasionratthemidatrojan

Malware Config

Targets

    • Target

      JaffaCakes118_b72f01503f93119443cc9cb1a96561a0

    • Size

      2.3MB

    • MD5

      b72f01503f93119443cc9cb1a96561a0

    • SHA1

      27e60439abacc18c1cca680fbf54b3d0e945a18a

    • SHA256

      05cd69760b7358e9f1d06a077bcac5776e788e6d3c2af917f1aa8bebe16d8b7a

    • SHA512

      8e0bf201f59a5a5b8ac019060100327db1e1daa64d256c41b6dc87abe5f6a1b2679ac3bd87e6c6fd95af0e50e315b0055fe537f1ad66346dce6652ba4e0014b0

    • SSDEEP

      49152:izCjo6k0aWbdhmvwoy+cAd314kpT3Kf8BfiUy6NN5gc:Po/AdhKwoyNI31v3FBfinmN5gc

    Score
    10/10
    sectopratdiscoveryevasionratthemidatrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks