General
-
Target
f0735a63fd64857e86abe87225f8b07b_JaffaCakes118
-
Size
478KB
-
Sample
240415-ggl1zsgb26
-
MD5
f0735a63fd64857e86abe87225f8b07b
-
SHA1
6cb8f6a4ea63b0fd7f920df1fb349e114d826e5a
-
SHA256
9d0a2a6c4a5684b2166cd3376edc954ece9a3079f2e23be31850e65412574cf1
-
SHA512
06d5a9dcb2306c5df9f9a00afd6a6bcf5901d1c0841ca175cba37d207bf9dab7266c9f48ce3acf82775cc11c98198818a153891949240cafbe9e3d07b848fc71
-
SSDEEP
12288:g8LtyjMZywtttJJZQ+G3CIVwCAVQp6kgB:XgqC+G3xUVQ8k
Static task
static1
Behavioral task
behavioral1
Sample
f0735a63fd64857e86abe87225f8b07b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f0735a63fd64857e86abe87225f8b07b_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
cybergate
2.6
Javadriveby
82.242.250.193:81
82.242.250.193:82
82.242.250.193:83
FR01D4HYH10S55G20TJH58S
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Java
-
install_file
JavaUdapter.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
Javadriveby
Targets
-
-
Target
f0735a63fd64857e86abe87225f8b07b_JaffaCakes118
-
Size
478KB
-
MD5
f0735a63fd64857e86abe87225f8b07b
-
SHA1
6cb8f6a4ea63b0fd7f920df1fb349e114d826e5a
-
SHA256
9d0a2a6c4a5684b2166cd3376edc954ece9a3079f2e23be31850e65412574cf1
-
SHA512
06d5a9dcb2306c5df9f9a00afd6a6bcf5901d1c0841ca175cba37d207bf9dab7266c9f48ce3acf82775cc11c98198818a153891949240cafbe9e3d07b848fc71
-
SSDEEP
12288:g8LtyjMZywtttJJZQ+G3CIVwCAVQp6kgB:XgqC+G3xUVQ8k
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-