General
- Target jaffacakes118_Worm.Win32.Vobfus.dmad.da33466de6c818af68e6c7b39a49288f
- Size 148KB
- Sample261015-2gdptstscv
- SHA256 9f27347f0d45f7fc5a4cca1c79aeb630680c0c67cbb5a25358f733c43a15194f
- MD5 da33466de6c818af68e6c7b39a49288f
- SHA1 4b60f4853b04418fe98933ad824a735d7051d572
- SHA512 305ac090f8a70074c0e7375101b4de7afe483e3dd1e07e4c533c43b0204ee6284cb61b7e1993341fd9aef836e4e7fc67d50a2780b52090d5a3a25ba6002257e2
- SSDEEP 3072:QiFeQh4mRpDGq7At/yRWr2wA3pnbMUq8hFOdhI2nE5j4oQ2co:/Fph96F90Wf4nJPwdkdZco
- TLSH T16FE3A22672D0F279D915CAF83D1983A4942AEC3525E2AC03F7C26B1B76B1DA7D320753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Worm.Win32.Vobfus.dmad.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Worm.Win32.Vobfus.dmad.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target jaffacakes118_Worm.Win32.Vobfus.dmad.da33466de6c818af68e6c7b39a49288f
- Size 148KB
- SHA256 9f27347f0d45f7fc5a4cca1c79aeb630680c0c67cbb5a25358f733c43a15194f
- MD5 da33466de6c818af68e6c7b39a49288f
- SHA1 4b60f4853b04418fe98933ad824a735d7051d572
- SHA512 305ac090f8a70074c0e7375101b4de7afe483e3dd1e07e4c533c43b0204ee6284cb61b7e1993341fd9aef836e4e7fc67d50a2780b52090d5a3a25ba6002257e2
- SSDEEP 3072:QiFeQh4mRpDGq7At/yRWr2wA3pnbMUq8hFOdhI2nE5j4oQ2co:/Fph96F90Wf4nJPwdkdZco
- TLSH T16FE3A22672D0F279D915CAF83D1983A4942AEC3525E2AC03F7C26B1B76B1DA7D320753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2