jaffacakes118_Rootkit[.]Win32[.]Agent[.]tyo[.]ebd6ce623b9df5c39e85ec6f7253d77a

General

Target
jaffacakes118_Rootkit.Win32.Agent.tyo.ebd6ce623b9df5c39e85ec6f7253d77a
Size 22KB
Sample261014-krbjsassb1
SHA256 e1126269b95b0a14bb30f3d905d8e442fc3f5842996c2ab0ce3fbf587974488b
MD5 ebd6ce623b9df5c39e85ec6f7253d77a
SHA1 524d8ca3ce575f9c45a0ab823f3e14767644d3cc
SHA512 af5256cbfc41d9d76e5757d3a80c05260caaaf1b1e9072ed9fe253bc4df86f9935d534849238d8c4b16e202e7dfc1bef20442e58d38ef2960ac547a9304f951f
SSDEEP 384:Gdds6S/zV6wyFKXctrppek/4ZERM8CePTuDlOrXcnZWByWVE2x:Ggz/zVr+dsF8HTcnsB
TLSH
T1C8B2E835A7922035D0F588B91D86B326B2B366310E2E8BCF25454E589CEDFE3F43160A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Rootkit.Win32.Agent.tyo.ebd6ce623b9df5c39e85ec6f7253d77a

File Explorer

jaffacakes118_Rootkit.Win32.Agent.tyo.ebd6ce623b9df5c39e85ec6f7253d77a

.sys 22KB

jaffacakes118_Rootkit.Win32.Agent.tyo.ebd6ce623b9df5c39e85ec6f7253d77a

IMPHASH ab33e00a60d7a135dadebff5a107e6b5
SHA256 e1126269b95b0a14bb30f3d905d8e442fc3f5842996c2ab0ce3fbf587974488b
MD5 ebd6ce623b9df5c39e85ec6f7253d77a
SHA1 524d8ca3ce575f9c45a0ab823f3e14767644d3cc
SHA512 af5256cbfc41d9d76e5757d3a80c05260caaaf1b1e9072ed9fe253bc4df86f9935d534849238d8c4b16e202e7dfc1bef20442e58d38ef2960ac547a9304f951f
SSDEEP 384:Gdds6S/zV6wyFKXctrppek/4ZERM8CePTuDlOrXcnZWByWVE2x:Ggz/zVr+dsF8HTcnsB
TLSH
T1C8B2E835A7922035D0F588B91D86B326B2B366310E2E8BCF25454E589CEDFE3F43160A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_Rootkit.Win32.Agent.tyo.ebd6ce623b9df5c39e85ec6f7253d77a

ntoskrnl.exe

hal

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Rootkit.Win32.Agent.tyo.ebd6ce623b9df5c39e85ec6f7253d77a

ntoskrnl.exe

hal

generic