Overview

overview

10

Static

static

5

JaffaCakes...1e.exe

windows10-2004-x64

10

JaffaCakes...1e.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_3b3da74d3abdc40ad9836a3b18d0d21e
  • Size 3.3MB
  • Sample251218-288dhs1jct
  • SHA256 96cf692ca4ff7996e45309e3a304da0b071c6ac3b4f9065cb1629d091dc5d7fc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
darkvncdefense_evasiondiscoveryrat

Malware Config

Targets

    • Target
      JaffaCakes118_3b3da74d3abdc40ad9836a3b18d0d21e
    • Size 3.3MB
    • SHA256 96cf692ca4ff7996e45309e3a304da0b071c6ac3b4f9065cb1629d091dc5d7fc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverydarkvncrat

    • DarkVNC

      DarkVNC is a malicious version of the famous VNC software.

      ratdarkvnc

    • Darkvnc family

      darkvnc

    • DarkVNC payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks