General
-
Target
fcf6f83a5c348ee70bf945bf1c9f025d_JaffaCakes118
-
Size
567KB
-
Sample
240420-rtdv9abb9y
-
MD5
fcf6f83a5c348ee70bf945bf1c9f025d
-
SHA1
8f67446f56a0e560df418491d00ac6863d81f8d8
-
SHA256
e35b0cad5eda7aee73577f43e1c1c1aa194a067052fba0ff70e78b05a2ee8020
-
SHA512
784aaff3ef1b2cd54dbf81c297798fd38582bcce3ac7e0b3f3164175c99c213987e4b6a7a30f9409dcb2b1836f9b65c5ae769d1fc2f47229d2dd86caf3a79dd6
-
SSDEEP
12288:acD663W92zkPaCxEF7IJqZ/8gCCo/08s0Vm:ah9Okly0qZGL/0Ym
Behavioral task
behavioral1
Sample
fcf6f83a5c348ee70bf945bf1c9f025d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fcf6f83a5c348ee70bf945bf1c9f025d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
cybergate
2.6
damn
lordinsane.no-ip.org:2000
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Iexplorer
-
install_file
Iexplorer.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Windows não consegue executar este arquivo.
-
message_box_title
Erro
-
password
abcd1234
-
regkey_hkcu
Win32
-
regkey_hklm
Win32
Targets
-
-
Target
fcf6f83a5c348ee70bf945bf1c9f025d_JaffaCakes118
-
Size
567KB
-
MD5
fcf6f83a5c348ee70bf945bf1c9f025d
-
SHA1
8f67446f56a0e560df418491d00ac6863d81f8d8
-
SHA256
e35b0cad5eda7aee73577f43e1c1c1aa194a067052fba0ff70e78b05a2ee8020
-
SHA512
784aaff3ef1b2cd54dbf81c297798fd38582bcce3ac7e0b3f3164175c99c213987e4b6a7a30f9409dcb2b1836f9b65c5ae769d1fc2f47229d2dd86caf3a79dd6
-
SSDEEP
12288:acD663W92zkPaCxEF7IJqZ/8gCCo/08s0Vm:ah9Okly0qZGL/0Ym
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-