General
-
Target
f8c6f91efa4817c54c437e33b9846157_JaffaCakes118
-
Size
7.6MB
-
Sample
240418-z7r9ssfc24
-
MD5
f8c6f91efa4817c54c437e33b9846157
-
SHA1
0d16268bef3a1489477deafa8e9b157259472590
-
SHA256
bebc94d1ba964a1cc1b23acfeb8b4ec4a5457649cf203e58c0e93c0161a0bf78
-
SHA512
b1b99e623044addcc59888638282d24d06ad1ab7043ba13d90ddaca9d26a7ee8d7742d6ece62d02735095699dd682f358b47abb4f7e72a92e3daa0d0c379401e
-
SSDEEP
196608:7TIrok2A+V/Dn9PzEhYq/GTH60OPsXjZNZwgz+MgF+64ju:7crok2AY7NgWqNDPsz/+Q64S
Static task
static1
Behavioral task
behavioral1
Sample
f8c6f91efa4817c54c437e33b9846157_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8c6f91efa4817c54c437e33b9846157_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
176.221.252.198:4444
Targets
-
-
Target
f8c6f91efa4817c54c437e33b9846157_JaffaCakes118
-
Size
7.6MB
-
MD5
f8c6f91efa4817c54c437e33b9846157
-
SHA1
0d16268bef3a1489477deafa8e9b157259472590
-
SHA256
bebc94d1ba964a1cc1b23acfeb8b4ec4a5457649cf203e58c0e93c0161a0bf78
-
SHA512
b1b99e623044addcc59888638282d24d06ad1ab7043ba13d90ddaca9d26a7ee8d7742d6ece62d02735095699dd682f358b47abb4f7e72a92e3daa0d0c379401e
-
SSDEEP
196608:7TIrok2A+V/Dn9PzEhYq/GTH60OPsXjZNZwgz+MgF+64ju:7crok2AY7NgWqNDPsz/+Q64S
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-