General
-
Target
fa8f303de71f03f604ae542ee85e74d0_JaffaCakes118
-
Size
363KB
-
Sample
240419-se18nsgc2t
-
MD5
fa8f303de71f03f604ae542ee85e74d0
-
SHA1
8e581a8b4908dcb992d534a9ad90839eb5cf1590
-
SHA256
2e8f6a93437ca35d664074db818fe342c7ba0aeb167d2b4a0d25b5bdc9e41e9c
-
SHA512
0313919c9e65dd60cff7617d94460760a9584008b9e45032001d3456d367a86106de0920777367501ed08c76c64c45bca73b9262537aaf9bc89b8d4739257204
-
SSDEEP
6144:Q3xtvJ/xa/c5d/hgQ8u3FWb6LcCPn+A2BL1uhqJq8zTjMjbVrq8IRJh0:AjFxVZhHQ6JPOBL1uhqNzfMonXh
Static task
static1
Behavioral task
behavioral1
Sample
fa8f303de71f03f604ae542ee85e74d0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa8f303de71f03f604ae542ee85e74d0_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
ultrafilterindia.com - Port:
587 - Username:
baroda@ultrafilterindia.com - Password:
ArBgL&%27
Targets
-
-
Target
fa8f303de71f03f604ae542ee85e74d0_JaffaCakes118
-
Size
363KB
-
MD5
fa8f303de71f03f604ae542ee85e74d0
-
SHA1
8e581a8b4908dcb992d534a9ad90839eb5cf1590
-
SHA256
2e8f6a93437ca35d664074db818fe342c7ba0aeb167d2b4a0d25b5bdc9e41e9c
-
SHA512
0313919c9e65dd60cff7617d94460760a9584008b9e45032001d3456d367a86106de0920777367501ed08c76c64c45bca73b9262537aaf9bc89b8d4739257204
-
SSDEEP
6144:Q3xtvJ/xa/c5d/hgQ8u3FWb6LcCPn+A2BL1uhqJq8zTjMjbVrq8IRJh0:AjFxVZhHQ6JPOBL1uhqNzfMonXh
-
Detect ZGRat V1
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-