sfone | jaffacakes118_Worm[.]Win32[.]Agent[.]cp[.]1b4264daa6f7067ef89aa

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Worm.Win32.Agent.cp.1b4264daa6f7067ef89aa
Size 819KB
Sample261008-wlqmasts6j
SHA256 0d48d84de122e1e5e8bfca4446205788d4f3f86a69a2d2f7183a58769002d3e1
MD5 7635b4bcb5a1b4264daa6f7067ef89aa
SHA1 691a6d20436791e8195b72ff92a6b75a19eb8d92
SHA512 22a4fb0503c1e5a4f2cda6316278784b6c479e1a5c069304815dee8c81e7f63fe0251424f0b4c7dee91962b90e14f71e50e2f4d4e6c5b9013ed9770c7456449e
SSDEEP 24576:oWDDtSiCIbarS06DTaV//hsaCnKnfkiiG1VK:VcieT6/sXhsaCnKMi3VK
TLSH
T1FF052352BA996477D4AA6E30368CF879680CC62710598C8FEFE4E54A5F0C7F0371C6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm sfone

Malware Config

Signatures

Family: Sfone
Sfone is a worm written in C++.
worm sfone

Detects Sfone worm 1 IoCs

resource	yara_rule
sample	family_sfone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Worm.Win32.Agent.cp.1b4264daa6f7067ef89aa

File Explorer

jaffacakes118_Worm.Win32.Agent.cp.1b4264daa6f7067ef89aa

.exe 819KB

jaffacakes118_Worm.Win32.Agent.cp.1b4264daa6f7067ef89aa

IMPHASH 4e73db19151d1ed485c4843f251684e3
SHA256 0d48d84de122e1e5e8bfca4446205788d4f3f86a69a2d2f7183a58769002d3e1
MD5 7635b4bcb5a1b4264daa6f7067ef89aa
SHA1 691a6d20436791e8195b72ff92a6b75a19eb8d92
SHA512 22a4fb0503c1e5a4f2cda6316278784b6c479e1a5c069304815dee8c81e7f63fe0251424f0b4c7dee91962b90e14f71e50e2f4d4e6c5b9013ed9770c7456449e
SSDEEP 24576:oWDDtSiCIbarS06DTaV//hsaCnKnfkiiG1VK:VcieT6/sXhsaCnKMi3VK
TLSH
T1FF052352BA996477D4AA6E30368CF879680CC62710598C8FEFE4E54A5F0C7F0371C6B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Sfone worm
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegConnectRegistryA OpenSCManagerA LockServiceDatabase OpenServiceA ChangeServiceConfigA StartServiceA CloseServiceHandle UnlockServiceDatabase EnumServicesStatusA ControlService DeleteService

shell32

FindExecutableA ShellExecuteA

mpr

WNetAddConnection2A WNetCancelConnection2A WNetOpenEnumA WNetEnumResourceA WNetCloseEnum WNetGetConnectionA

kernel32

GetDriveTypeA GetWindowsDirectoryA GetComputerNameA GetLastError Sleep GetModuleFileNameA GetLocalTime CreateThread OpenMutexA ReleaseMutex CreateMutexA CloseHandle GetVersionExA CreateFileA CreateFileMappingA MapViewOfFile WriteFile SetFilePointer FindFirstFileA FindNextFileA FindClose OpenProcess TerminateProcess CreateToolhelp32Snapshot Process32First Process32Next LoadLibraryA GetProcAddress FreeLibrary GetSystemTimeAsFileTime SetConsoleCtrlHandler GetStartupInfoA GetModuleHandleA VirtualAlloc VirtualQuery HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize HeapValidate ExitProcess RtlUnwind GetFileType GetStdHandle GetCurrentProcess DuplicateHandle SetHandleCount GetCommandLineA GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetTimeZoneInformation SetStdHandle DeleteFileA ReadFile SetEndOfFile

user32

GetWindowTextA GetWindowThreadProcessId EnumWindows

ws2_32

socket htonl htons bind recvfrom sendto WSAStartup WSACleanup inet_addr gethostbyname gethostbyaddr