General
- Target jaffacakes118_not-a-virus.Server-FTP.Win32.Serv-U.5100.b466e9f9a981eb0b8004f1d07c08d294
- Size 1.5MB
- Sample261014-gna73aef97
- SHA256 efafd766ddcefb43e9a5bacea5040d42c1831d67cf0d63a6c24fe623c94b1021
Score
8/10
Malware Config
Targets
-
- Target jaffacakes118_not-a-virus.Server-FTP.Win32.Serv-U.5100.b466e9f9a981eb0b8004f1d07c08d294
- Size 1.5MB
- SHA256 efafd766ddcefb43e9a5bacea5040d42c1831d67cf0d63a6c24fe623c94b1021
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Remote Services: SMB/Windows Admin Shares
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.