Overview

overview

10

Static

static

3

118f52b809...18.exe

windows7-x64

10

118f52b809...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    118f52b809205173695432ce0cb8f549_JaffaCakes118

  • Size

    180KB

  • Sample

    240626-lq894a1fmk

  • MD5

    118f52b809205173695432ce0cb8f549

  • SHA1

    9e8630d903a44945f7e0b107005b20026fcc0ac5

  • SHA256

    119aed96b731f84dc4bc6cf38f8f2110373c266e5ef18f49eacf7ce1e106ce2c

  • SHA512

    e401f8a4a1e132867ef7073ac707f19696add75e8f91a78d868cd5d5c91e00ba688671af41a8c02f7a6a9728363ee40d9b4d8efa0f23d9982298e12c25ac1b27

  • SSDEEP

    1536:6n4Og5YjenvitHCEwgDGvQ5ubNSFTNq/:6BgGBHCPIRTNq/

Score
10/10
guloaderdownloaderpersistence

Malware Config

Extracted

Family

guloader

C2

http://62.113.202.111/Remmy_jMBaBPxmX117.bin

xor.base64

Targets

    • Target

      118f52b809205173695432ce0cb8f549_JaffaCakes118

    • Size

      180KB

    • MD5

      118f52b809205173695432ce0cb8f549

    • SHA1

      9e8630d903a44945f7e0b107005b20026fcc0ac5

    • SHA256

      119aed96b731f84dc4bc6cf38f8f2110373c266e5ef18f49eacf7ce1e106ce2c

    • SHA512

      e401f8a4a1e132867ef7073ac707f19696add75e8f91a78d868cd5d5c91e00ba688671af41a8c02f7a6a9728363ee40d9b4d8efa0f23d9982298e12c25ac1b27

    • SSDEEP

      1536:6n4Og5YjenvitHCEwgDGvQ5ubNSFTNq/:6BgGBHCPIRTNq/

    Score
    10/10
    guloaderdownloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks