Extracted

Extracted

Extracted

Extracted

• • Target
    jaffacakes118_2b35b12fd8b68b9696a882fc96866ad0d5dee78403a7dc0fc1a015b485ac9a8c.bin
  • Size 13.5MB
  • SHA256 2b35b12fd8b68b9696a882fc96866ad0d5dee78403a7dc0fc1a015b485ac9a8c
  • MD5 5e14121ab4b80269e52f42809424fc2f
  • SHA1 d892048467175ddb8a084beb048bf64a16523d41
  • SHA512 b44271db389325a94653681588379a7d77f4d4eedef95f8552785e3880560c69c777da012b45a4d272a6fd1fbbd4c7ba4e13a4280109d870fabe337d4d9c8c7f
  • SSDEEP 196608:BdTAP9/Xw3ghlCU0uX37sYNZnQfoXOp3jeVJJYudbDtJLtnEsEkgdvQ98zM:vYXwN7uX3QZf036uR5ZtEpkgdvQ98z
  • TLSH
    T1B9E6E068B7DDA888F273EE92AFC5FD66578FA321433AD1ED6118025D523349CC912C6C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbotnetde�aultup3defense_evasiondiscoverydropperexecutiongluptebasmokeloadersocks5systemzstealcxmrigloaderminerpersistenceprivilege_escalationrootkitstealertrojan

  • Detect Socks5Systemz Payload

  • Family: Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Family: Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Glupteba payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    defense_evasiontrojan

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitdefense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2