General
-
Target
e4b803b42eae0713404868a8f745c9cf_JaffaCakes118
-
Size
964KB
-
Sample
240407-mkn8eabb54
-
MD5
e4b803b42eae0713404868a8f745c9cf
-
SHA1
93dfdd64149dbf20134dac70fcd806e5f41b4ae7
-
SHA256
5a66764f2e1586ac36f0046ff98e0e45b72801a67110df4b86ae7ae8dd21b781
-
SHA512
9f7797d6eff8f7575b16a9afcbca77b48597eedd8f0a2013b5d656668f4721e7e4bf243ca9829fd9b5f001205b98bd870baa82f6c270510bf4b81e1430a8c8b8
-
SSDEEP
24576:F806+lzHBIiDJS6wkfHi/vm93i7P+d18nDTcwxkXAhVH:F8zIHpi29ya1gcwd
Static task
static1
Behavioral task
behavioral1
Sample
e4b803b42eae0713404868a8f745c9cf_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e4b803b42eae0713404868a8f745c9cf_JaffaCakes118.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
darkcomet
Guest16
d50.no-ip.org:1604
DC_MUTEX-1QPKE55
-
gencode
2atCqqo2uTVX
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
e4b803b42eae0713404868a8f745c9cf_JaffaCakes118
-
Size
964KB
-
MD5
e4b803b42eae0713404868a8f745c9cf
-
SHA1
93dfdd64149dbf20134dac70fcd806e5f41b4ae7
-
SHA256
5a66764f2e1586ac36f0046ff98e0e45b72801a67110df4b86ae7ae8dd21b781
-
SHA512
9f7797d6eff8f7575b16a9afcbca77b48597eedd8f0a2013b5d656668f4721e7e4bf243ca9829fd9b5f001205b98bd870baa82f6c270510bf4b81e1430a8c8b8
-
SSDEEP
24576:F806+lzHBIiDJS6wkfHi/vm93i7P+d18nDTcwxkXAhVH:F8zIHpi29ya1gcwd
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Suspicious use of SetThreadContext
-