General
- Target jaffacakes118_Worm.Win32.Vobfus.erym.f73590198b855ee439e421e0b894e4f9
- Size 148KB
- Sample261014-qjejcsvzew
- SHA256 b5578244c6d58e5c54911f4ab9f7b9822f37dfccc6883e8d735f67322bac3bfb
- MD5 f73590198b855ee439e421e0b894e4f9
- SHA1 139a84a2ce8347739b3b216f35996488cd735126
- SHA512 2ea4866516f1f2b1079c9d71399a8c8996336dd050a819928a0f08677f801f6e461bdaa470de48102ac832c648f070222ac64f94840ed6b62582be16aa491574
- SSDEEP 3072:8iFyQh4mRpDGq7At/yRWr2wA3pnbMUq8hFOdhIU4oQZiEcA:LFth96F90Wf4nJPwdjWN
- TLSH T1AFE3C42A7291F27AD414CAF83D1982E09479EC3621D2AC17F7C16B1B76B1D9BD320763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Worm.Win32.Vobfus.erym.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Worm.Win32.Vobfus.erym.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target jaffacakes118_Worm.Win32.Vobfus.erym.f73590198b855ee439e421e0b894e4f9
- Size 148KB
- SHA256 b5578244c6d58e5c54911f4ab9f7b9822f37dfccc6883e8d735f67322bac3bfb
- MD5 f73590198b855ee439e421e0b894e4f9
- SHA1 139a84a2ce8347739b3b216f35996488cd735126
- SHA512 2ea4866516f1f2b1079c9d71399a8c8996336dd050a819928a0f08677f801f6e461bdaa470de48102ac832c648f070222ac64f94840ed6b62582be16aa491574
- SSDEEP 3072:8iFyQh4mRpDGq7At/yRWr2wA3pnbMUq8hFOdhIU4oQZiEcA:LFth96F90Wf4nJPwdjWN
- TLSH T1AFE3C42A7291F27AD414CAF83D1982E09479EC3621D2AC17F7C16B1B76B1D9BD320763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2