Overview

overview

10

Static

static

7

18e612312d...18.exe

windows7-x64

10

18e612312d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18e612312dda929d462d4cffff63e2a0_JaffaCakes118

  • Size

    5.1MB

  • Sample

    240628-fv6f4ssgqb

  • MD5

    18e612312dda929d462d4cffff63e2a0

  • SHA1

    d5890c9f3e56587973e3a88d6d9590d1ca337b55

  • SHA256

    cecf08bbe65010ef94f110d4d6e80ab67ecdc19fe94fbe951be42d627dbddae5

  • SHA512

    1226c10a3f4b24b043ba62091f991b57139deda9ad8d77f08df7c8a7fddfc5a71c59c4f918c9fcea5ef815ebfc080eb02864f42097a4623b1686e5dc1b8cf7bb

  • SSDEEP

    98304:mxIL14i+XZW3RJcY0BeuCiNB8X5jP9BM0zXsskQQSSmnM6DAvivcE:ma14nY0BV7NB8pjlBM81FQS+6Di8cE

Score
10/10
sectopratevasionratthemidatrojan

Malware Config

Targets

    • Target

      18e612312dda929d462d4cffff63e2a0_JaffaCakes118

    • Size

      5.1MB

    • MD5

      18e612312dda929d462d4cffff63e2a0

    • SHA1

      d5890c9f3e56587973e3a88d6d9590d1ca337b55

    • SHA256

      cecf08bbe65010ef94f110d4d6e80ab67ecdc19fe94fbe951be42d627dbddae5

    • SHA512

      1226c10a3f4b24b043ba62091f991b57139deda9ad8d77f08df7c8a7fddfc5a71c59c4f918c9fcea5ef815ebfc080eb02864f42097a4623b1686e5dc1b8cf7bb

    • SSDEEP

      98304:mxIL14i+XZW3RJcY0BeuCiNB8X5jP9BM0zXsskQQSSmnM6DAvivcE:ma14nY0BV7NB8pjlBM81FQS+6Di8cE

    Score
    10/10
    sectopratevasionratthemidatrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks