General
-
Target
734e49a5eb9193a08ab2a1f66c4ec254_JaffaCakes118
-
Size
256KB
-
Sample
240401-rla5dsgd92
-
MD5
734e49a5eb9193a08ab2a1f66c4ec254
-
SHA1
bc1004564de46d39269e7c844d1094f869c988d8
-
SHA256
c12bd972fbf3301e40fa75c3e295a8bd0233bf1f5fa100e79ab7f6755f7b6788
-
SHA512
89c4a188c143ba5d9a636f733b475ba9e67aae287cb36f26b471d0fed29a46ba8b1f9032358c22eeee8463c3667eb5d054c822aaa5a6f4d91b47bfd19e558f38
-
SSDEEP
6144:F8LxBsrsWflA8ZsgGbNjZSgG/OgZj636ggHVviSMdEi9i4:/pflA8aZ8/H56EV60i9i4
Static task
static1
Behavioral task
behavioral1
Sample
734e49a5eb9193a08ab2a1f66c4ec254_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
734e49a5eb9193a08ab2a1f66c4ec254_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ppaogsrxq.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ppaogsrxq.dll
Resource
win10v2004-20240226-en
Malware Config
Extracted
formbook
4.1
rv9n
olivia-grace.show
zhuwww.com
keiretsu.xyz
olidnh.space
searuleansec.com
2fastrepair.com
brooklynmetalroof.com
scodol.com
novaprint.pro
the-loaner.com
nextroundscap.com
zbwlggs.com
internetautodealer.com
xn--tornrealestate-ekb.com
yunjiuhuo.com
skandinaviskakryptobanken.com
coxivarag.rest
ophthalmologylab.com
zzzzgjcdbqnn98.net
doeful.com
beatthebank.fund
deposit-pulsa2021.xyz
uptownsecuritysystems.com
thegroveonglendale.com
destinationth.com
healthcareuninsured.com
longhang.xyz
ypxwwxjqcqhutyp.com
ip-15-235-90.net
rancholachiquita.com
macblog.xyz
skillsbazar.com
beatyup.com
academiapinto.com
myguagua.com
fto8y.com
ohioleads.net
paravocebrasil.com
thecanyonmanor.com
acu-bps.com
comunicaretresessanta.net
schwa-bingcorp.com
discountcouponcodes-jp.space
kufazo.online
metaverge.club
800car.online
brendanbaehr.com
garfieldtoken.net
secretfoldr.com
13itcasino.com
marketingatelier.net
computersslide.com
marcastudios.com
thestreetsoflondon.life
maintaintest.com
cronicasdebia.com
apm-app.com
sepulchral.xyz
lodha-project.com
theartofsoulwork.com
swimminglessonsshop.com
klarnabet.com
control-of-space.net
heliumathletic.com
cjspizza.net
Targets
-
-
Target
734e49a5eb9193a08ab2a1f66c4ec254_JaffaCakes118
-
Size
256KB
-
MD5
734e49a5eb9193a08ab2a1f66c4ec254
-
SHA1
bc1004564de46d39269e7c844d1094f869c988d8
-
SHA256
c12bd972fbf3301e40fa75c3e295a8bd0233bf1f5fa100e79ab7f6755f7b6788
-
SHA512
89c4a188c143ba5d9a636f733b475ba9e67aae287cb36f26b471d0fed29a46ba8b1f9032358c22eeee8463c3667eb5d054c822aaa5a6f4d91b47bfd19e558f38
-
SSDEEP
6144:F8LxBsrsWflA8ZsgGbNjZSgG/OgZj636ggHVviSMdEi9i4:/pflA8aZ8/H56EV60i9i4
-
Formbook payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/ppaogsrxq.dll
-
Size
27KB
-
MD5
d107655bb6ff7414a4b7e213018dbcc0
-
SHA1
60bc8bb8a9bfd467710e327442d3c40f1932ae9a
-
SHA256
445db3e8eac414027f51845bb0474d453d5a3f03d618d7f0e14a0ff8d2fca03b
-
SHA512
547d32d5781e216c061a261b6d7cb974a2c9509be1e2a4b613cf537539b738ae064b97704fec56cb90a64e63bc38f2730ac2a3aefc58aafb0046f119b3c22c2e
-
SSDEEP
768:boFujLc9Rml6YRXFbSNAkYaX7mspbtbQ9HMyMZ:kkLUml6KzaJpZM9HZu
-
Formbook payload
-
Suspicious use of SetThreadContext
-