Extracted

Extracted

• • Target
    jaffacakes118_10299cd0bd70ae15c36311bbd52624d45ab1ec737314d59ce2b239b0b6e5427c.bin
  • Size 4.1MB
  • SHA256 10299cd0bd70ae15c36311bbd52624d45ab1ec737314d59ce2b239b0b6e5427c
  • MD5 129914c3124a6fba249b61232b697325
  • SHA1 2eb62e2d40a2e466c4f608d368dad5a4a39622cb
  • SHA512 ea77e584dc26565cc724b39768724a011d290b31db28e949836941c534ddf58da2068ed310f0bdc685a2706e20c85aa2c6e7acade0f8f84d9d31db081706294c
  • SSDEEP 98304:zsFRhwd//2+WkGw3sohLpm49ad+O4xFtEa13:Q9z+WC3sohLpmHda5
  • TLSH
    T1FB163352F5FCC1B3FB690BB12CD302932A31BC824B74E7595A1768492C776A8873A717
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fbf543defense_evasiondiscoveryexecutionamadeylummapersistencestealertrojan

  • Detects Amadey x86-bit Payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1