General
-
Target
c048209154042d9ff5514cfd008df4bd_JaffaCakes118
-
Size
1.4MB
-
Sample
240404-xqv81sgb99
-
MD5
c048209154042d9ff5514cfd008df4bd
-
SHA1
a51cfe496eeacc2cdc18a5bee96e0103a7814853
-
SHA256
ae0f20124bf7ef06bf7eb4de7243ef4cf08b6523b791547c5f9f106f565b4366
-
SHA512
be5cbf56f665ec84ba38db38981892ac96f9cce3151ed1fe484a8ea1a5c67898c3b2c0e9a58baa0dd085ceccb973065cbb33050e6e4c0d4b31814e63ed6dccd7
-
SSDEEP
24576:PxpXPaR2J33o3S7P5zuHHOF2CxfehMHsGKzOYCMEMfX43Z1oI:5py+VDi8rgHfX43Z2I
Behavioral task
behavioral1
Sample
c048209154042d9ff5514cfd008df4bd_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.znsjis.top/
Targets
-
-
Target
c048209154042d9ff5514cfd008df4bd_JaffaCakes118
-
Size
1.4MB
-
MD5
c048209154042d9ff5514cfd008df4bd
-
SHA1
a51cfe496eeacc2cdc18a5bee96e0103a7814853
-
SHA256
ae0f20124bf7ef06bf7eb4de7243ef4cf08b6523b791547c5f9f106f565b4366
-
SHA512
be5cbf56f665ec84ba38db38981892ac96f9cce3151ed1fe484a8ea1a5c67898c3b2c0e9a58baa0dd085ceccb973065cbb33050e6e4c0d4b31814e63ed6dccd7
-
SSDEEP
24576:PxpXPaR2J33o3S7P5zuHHOF2CxfehMHsGKzOYCMEMfX43Z1oI:5py+VDi8rgHfX43Z2I
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-