General
-
Target
01863136c202a0df665d3c05549f6f0f_JaffaCakes118
-
Size
570KB
-
Sample
240328-klrzksge8z
-
MD5
01863136c202a0df665d3c05549f6f0f
-
SHA1
3c7491155a98d6a50e54f0ded6b6acf95e7e0eb8
-
SHA256
b75d52e883034848f4e22ae6a13d42cb6bc85dce0dd524572c9d9ba1a81f9ca1
-
SHA512
6c24a8676b5fd3d369a71660e7787c490e017378bfc6a0d3548c76d9910b7302c72df0628e513d1f75ceee0559b3b28824d5ee748e506099d25b7f120e972476
-
SSDEEP
6144:hmpz5hiNU5PRLGGTxcwQbyc8DdgiJdBL2nFeIOl8V6IghYNmnTV+WEZ4Z+YirYP2:hzaPtGkQbaDdbDBL2JW8II9WEifsSJo
Static task
static1
Behavioral task
behavioral1
Sample
01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe
Resource
win7-20231129-en
Malware Config
Extracted
formbook
4.1
gd3e
losfesdffewfdskokoka11.xyz
aspenroofingel.net
mlstrategygroup.com
breakaway.asia
gzmx3.com
dronesadvise.com
bitmain.discount
lifestylekenya.com
dragonfly-road.store
rumbaughrecruiting.com
tarimech.com
starmcb.com
xn--kfz-schlsseldienst-t6b.com
eqgiftshop.com
regionsi.com
bonsainer.com
guideofguardians.com
orlv7x.icu
xemnha100.com
thelupinlady.com
irideomacula.xyz
xanudu.com
fudgeho.com
mrkambu.com
lovedhouseishome.com
qualesusings.xyz
habbinz.online
video-registrator.site
abccookiebiz.com
betterpeixun.com
hotosita.website
metamars.life
journalofmj.com
magnoliagarnish.com
ziyouff.com
moneyshotvid.com
lariontsev.com
hulattsfurniture.com
vidoil.net
rostovetagi.store
trafalgarlonepiece.com
xyperfumecollection.com
northfaceuksaleoutlet.com
rupiahtoto.tech
primordialroot.com
emsteapot.com
dentistryforhealthnj.com
sanaoll.com
zmapo.xyz
mobilenotaryservicesfl.com
evolvevigor.com
2sscu.icu
tafefg.online
squid-mask.net
bluetulipboutique.com
chelsearenee.coach
pepsigoandplay.com
narrativenips.com
seowhiteflag.com
toiletseatsgalore.com
tongchibo.com
antiquestores.xyz
richardfecteau2021.com
cosmosglobaltrade.xyz
lasakaya.com
Targets
-
-
Target
01863136c202a0df665d3c05549f6f0f_JaffaCakes118
-
Size
570KB
-
MD5
01863136c202a0df665d3c05549f6f0f
-
SHA1
3c7491155a98d6a50e54f0ded6b6acf95e7e0eb8
-
SHA256
b75d52e883034848f4e22ae6a13d42cb6bc85dce0dd524572c9d9ba1a81f9ca1
-
SHA512
6c24a8676b5fd3d369a71660e7787c490e017378bfc6a0d3548c76d9910b7302c72df0628e513d1f75ceee0559b3b28824d5ee748e506099d25b7f120e972476
-
SSDEEP
6144:hmpz5hiNU5PRLGGTxcwQbyc8DdgiJdBL2nFeIOl8V6IghYNmnTV+WEZ4Z+YirYP2:hzaPtGkQbaDdbDBL2JW8II9WEifsSJo
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-