General
-
Target
f048e67cc8bab2caf9435c2b90d50e98_JaffaCakes118
-
Size
3.2MB
-
Sample
240415-et9xgaec66
-
MD5
f048e67cc8bab2caf9435c2b90d50e98
-
SHA1
355013d007818be0492a9901e49b4b08eca97c07
-
SHA256
a0d24046e0163fe30edd9cf0c27f3a4cd59435b95c2da05bfcfa329c240bf7a2
-
SHA512
c558df1942ce5634ba1ef23cdf467338a2ce757a0c74c20f19db6ffa158cff718bca550dc1848b462f874f330dff4fd08947b50e9b33d3bd516dae39c7bddcee
-
SSDEEP
49152:jMb83QBX4PU0ga6edgVVO90D9naQEQEdFEqSpRZFWwDxtKfrtDCV+m1SYj:jWX4PU076TV89S9nhRzqSRy6SLmj
Behavioral task
behavioral1
Sample
f048e67cc8bab2caf9435c2b90d50e98_JaffaCakes118.exe
Resource
win7-20240215-en
Malware Config
Extracted
cryptbot
bunole21.top
moreid02.top
Targets
-
-
Target
f048e67cc8bab2caf9435c2b90d50e98_JaffaCakes118
-
Size
3.2MB
-
MD5
f048e67cc8bab2caf9435c2b90d50e98
-
SHA1
355013d007818be0492a9901e49b4b08eca97c07
-
SHA256
a0d24046e0163fe30edd9cf0c27f3a4cd59435b95c2da05bfcfa329c240bf7a2
-
SHA512
c558df1942ce5634ba1ef23cdf467338a2ce757a0c74c20f19db6ffa158cff718bca550dc1848b462f874f330dff4fd08947b50e9b33d3bd516dae39c7bddcee
-
SSDEEP
49152:jMb83QBX4PU0ga6edgVVO90D9naQEQEdFEqSpRZFWwDxtKfrtDCV+m1SYj:jWX4PU076TV89S9nhRzqSRy6SLmj
-
CryptBot payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-