General
- Target jaffacakes118_Trojan-Dropper.Win32.Small.ahp.7e26ecc7175ef8bfedff84a07a9ce413
- Size 344KB
- Sample261006-trd5caax4w
- SHA256 f9afc207fc8e46ea5864ada2cff2c9be2a063f6c228922635d42d033814680a7
Score
10/10
Malware Config
Targets
-
- Target jaffacakes118_Trojan-Dropper.Win32.Small.ahp.7e26ecc7175ef8bfedff84a07a9ce413
- Size 344KB
- SHA256 f9afc207fc8e46ea5864ada2cff2c9be2a063f6c228922635d42d033814680a7
Score10/10Detects ProRat payload
Family: ProRat
ProRat is a Windows RAT written in C++.
Modifies WinLogon for persistence
Adds policy Run key to start application
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Modifies WinLogon
Network Share Discovery
Attempt to gather information on host network.
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2