General
-
Target
024af9966494feedce5c13f5073cb753_JaffaCakes118
-
Size
1.0MB
-
Sample
240427-dsl9caaf91
-
MD5
024af9966494feedce5c13f5073cb753
-
SHA1
7126bb8221480516f70b266e6370b44ede87c1fd
-
SHA256
07dc705da27544ca4d232515c665dff2bbbf6b0ab49fd07c602e20d6a512b4af
-
SHA512
91d44fa19e7ec5b1fb825fdacf2a4e0de1dbc464dcf0469418cf9ec357de1d8cf1a5955081d27a72c47af204e80062cb46f20458275b6c2655ba5d8ca8564770
-
SSDEEP
12288:wVbaHbD19/nXEx5xuzi6AoS5qt4cW+EEFsfZdGvvOWTbP:wZ+bh9cTottW+jKZI3OWTD
Static task
static1
Behavioral task
behavioral1
Sample
024af9966494feedce5c13f5073cb753_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
qakbot
325.43
abc004
1600240826
96.227.127.13:443
98.22.65.76:443
67.165.206.193:993
50.244.112.10:995
72.204.242.138:465
72.36.59.46:2222
68.174.15.223:443
69.11.247.242:443
75.81.25.223:443
95.77.223.148:443
47.146.32.175:443
50.232.172.114:443
24.231.54.185:2222
184.180.157.203:2222
190.31.192.182:443
84.47.220.117:995
96.18.240.158:443
117.199.14.80:443
184.97.148.2:443
207.255.161.8:993
69.167.206.238:50001
173.26.189.151:443
2.90.44.121:995
78.96.199.79:443
156.213.179.139:443
84.232.238.30:443
213.31.203.48:2222
36.77.151.211:443
71.187.170.235:443
24.218.181.15:443
199.247.22.145:443
207.255.161.8:32100
207.255.161.8:2078
96.41.93.96:443
188.51.33.232:995
50.244.112.106:443
24.37.178.158:443
47.28.131.209:443
141.158.47.123:443
72.204.242.138:990
41.228.203.53:443
72.179.13.59:443
186.94.5.67:2078
175.211.225.118:443
178.222.113.168:995
50.104.68.223:443
98.16.204.189:995
189.231.196.236:443
67.209.195.198:443
80.14.209.42:2222
84.117.176.32:443
207.255.161.8:995
2.7.65.32:2222
120.150.60.189:995
73.228.1.246:443
209.137.209.163:995
185.246.9.69:995
45.32.154.10:443
24.205.42.241:443
199.247.16.80:443
207.246.75.201:443
45.77.193.83:443
72.190.101.70:443
80.195.103.146:2222
188.24.196.245:995
2.91.109.154:995
188.247.252.243:443
203.198.96.200:443
67.170.137.8:443
47.138.201.136:443
144.139.47.206:443
31.5.21.66:443
96.30.198.161:443
95.179.247.224:443
117.218.208.239:443
92.59.35.196:2222
24.210.45.215:443
98.26.50.62:995
72.204.242.138:20
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
72.204.242.138:53
5.12.0.239:443
74.75.216.202:443
173.22.125.129:2222
86.98.89.62:2222
39.36.105.140:995
65.131.34.101:995
84.78.128.76:2222
2.90.109.29:995
24.53.49.240:2222
51.223.158.125:443
217.165.164.132:2222
72.209.191.27:443
189.183.73.227:995
47.44.217.98:443
84.247.55.190:443
71.221.92.98:443
103.76.160.110:443
47.146.169.85:443
80.240.26.178:443
67.60.113.253:2222
75.87.161.32:995
66.222.88.126:995
24.201.79.208:2078
24.234.86.201:995
47.147.11.28:443
65.30.213.13:6882
95.76.109.181:443
24.40.173.134:443
75.136.40.155:443
134.0.196.46:995
5.12.194.114:2222
2.50.59.219:443
172.78.30.215:443
190.85.91.154:443
5.193.181.221:2078
75.182.214.87:443
73.200.219.143:443
63.155.74.135:995
68.13.99.24:443
173.81.22.215:443
98.121.187.78:443
187.206.64.235:995
83.110.6.64:2222
103.206.112.234:443
216.201.162.158:443
37.210.186.213:61201
69.123.179.70:443
71.126.139.251:443
71.84.5.114:995
59.26.204.144:443
108.178.66.82:995
134.228.24.29:443
76.170.77.99:995
184.98.103.204:995
166.62.180.194:2078
108.185.113.12:443
216.163.4.136:443
66.215.32.224:443
71.220.200.82:2222
35.134.202.234:443
117.215.198.3:443
72.204.242.138:32102
77.159.149.74:443
207.255.161.8:465
200.75.136.78:443
45.46.53.140:2222
202.141.244.118:995
Targets
-
-
Target
024af9966494feedce5c13f5073cb753_JaffaCakes118
-
Size
1.0MB
-
MD5
024af9966494feedce5c13f5073cb753
-
SHA1
7126bb8221480516f70b266e6370b44ede87c1fd
-
SHA256
07dc705da27544ca4d232515c665dff2bbbf6b0ab49fd07c602e20d6a512b4af
-
SHA512
91d44fa19e7ec5b1fb825fdacf2a4e0de1dbc464dcf0469418cf9ec357de1d8cf1a5955081d27a72c47af204e80062cb46f20458275b6c2655ba5d8ca8564770
-
SSDEEP
12288:wVbaHbD19/nXEx5xuzi6AoS5qt4cW+EEFsfZdGvvOWTbP:wZ+bh9cTottW+jKZI3OWTD
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-