General
-
Target
e9cbe181180f938d649cece9bd9d4e3f_JaffaCakes118
-
Size
319KB
-
Sample
240409-mm6kgacg79
-
MD5
e9cbe181180f938d649cece9bd9d4e3f
-
SHA1
0a476de53d88218be1165315a98a0c7898b7d997
-
SHA256
b04791153b4f7b15aff1c868064f087fbd1004f8c42aab3a577f9398623159eb
-
SHA512
b2086ac964193daf2557c4ccdb0282302c4d47305f5c7663a4bf5079e50e1fb133c67108ecfbe764cbdaf0742a4ac9250d89875a4b60ca6ef0ff29e7fda10906
-
SSDEEP
6144:tel4Y9GgGam5m4aTsrpcwTGKbMFavS2Vqy8/GfY3Zl021yDTuJy:tel4Ykg45m4hVVGK3vFXrw3ZZ1yfoy
Static task
static1
Behavioral task
behavioral1
Sample
e9cbe181180f938d649cece9bd9d4e3f_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
cryptbot
pacdpo22.top
moreil02.top
-
payload_url
http://zukelx03.top/download.php?file=lv.exe
Targets
-
-
Target
e9cbe181180f938d649cece9bd9d4e3f_JaffaCakes118
-
Size
319KB
-
MD5
e9cbe181180f938d649cece9bd9d4e3f
-
SHA1
0a476de53d88218be1165315a98a0c7898b7d997
-
SHA256
b04791153b4f7b15aff1c868064f087fbd1004f8c42aab3a577f9398623159eb
-
SHA512
b2086ac964193daf2557c4ccdb0282302c4d47305f5c7663a4bf5079e50e1fb133c67108ecfbe764cbdaf0742a4ac9250d89875a4b60ca6ef0ff29e7fda10906
-
SSDEEP
6144:tel4Y9GgGam5m4aTsrpcwTGKbMFavS2Vqy8/GfY3Zl021yDTuJy:tel4Ykg45m4hVVGK3vFXrw3ZZ1yfoy
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-