General

  • Target

    JaffaCakes118_955d65240e48706a349119925555fbc8

  • Size

    410KB

  • Sample

    250329-ydvbmawlz4

  • MD5

    955d65240e48706a349119925555fbc8

  • SHA1

    ba3eed67a20b0bd97b5aae3dcf93106f9ee0f108

  • SHA256

    8d42055f4fd83eb93c26c92949b7ff63174e7d70658b362c4ac562713b95d07e

  • SHA512

    fd9aa5e1fe4232e3e225768597cd7ef622187dc371bafddc272f459882674b3e9ecb529540c359b89058bcb2e50f99541132e3e9e85a928b23f5221b96054170

  • SSDEEP

    12288:hfN2sDqTb56hY1i1H+hy/DvkNFe8wOlhsNJBNKLf:znYb56QiYKvkzPvsvY

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      JaffaCakes118_955d65240e48706a349119925555fbc8

    • Size

      410KB

    • MD5

      955d65240e48706a349119925555fbc8

    • SHA1

      ba3eed67a20b0bd97b5aae3dcf93106f9ee0f108

    • SHA256

      8d42055f4fd83eb93c26c92949b7ff63174e7d70658b362c4ac562713b95d07e

    • SHA512

      fd9aa5e1fe4232e3e225768597cd7ef622187dc371bafddc272f459882674b3e9ecb529540c359b89058bcb2e50f99541132e3e9e85a928b23f5221b96054170

    • SSDEEP

      12288:hfN2sDqTb56hY1i1H+hy/DvkNFe8wOlhsNJBNKLf:znYb56QiYKvkzPvsvY

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks