General
-
Target
ca96c3c815466dc3cec7790748828f96_JaffaCakes118
-
Size
158KB
-
Sample
240405-evq6rabh6s
-
MD5
ca96c3c815466dc3cec7790748828f96
-
SHA1
f6cf4487461d1c734c525d479ce8fd1e8fc9cc66
-
SHA256
e3bc6611b1274ca7a084d9d79238cc690035dca46b2a2764c7e5bc5ab6a3126f
-
SHA512
881edd28bec2e4e577a894a90b0ec395b7e08fb630281863f3ca22297c45e5d199ab8fdb418835a02eb87843a23cb92e3424ccc076e31229df6823c5097e9ff6
-
SSDEEP
3072:hH6q5yhBlKuU1DDjJsmiN3XhC7RbyIv/w7g8ZdcY:5kl9U4mgM7RbLHcg8Zm
Behavioral task
behavioral1
Sample
ca96c3c815466dc3cec7790748828f96_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
ca96c3c815466dc3cec7790748828f96_JaffaCakes118
-
Size
158KB
-
MD5
ca96c3c815466dc3cec7790748828f96
-
SHA1
f6cf4487461d1c734c525d479ce8fd1e8fc9cc66
-
SHA256
e3bc6611b1274ca7a084d9d79238cc690035dca46b2a2764c7e5bc5ab6a3126f
-
SHA512
881edd28bec2e4e577a894a90b0ec395b7e08fb630281863f3ca22297c45e5d199ab8fdb418835a02eb87843a23cb92e3424ccc076e31229df6823c5097e9ff6
-
SSDEEP
3072:hH6q5yhBlKuU1DDjJsmiN3XhC7RbyIv/w7g8ZdcY:5kl9U4mgM7RbLHcg8Zm
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-