General
-
Target
053aaab62e8b79a398c655ac0834266e_JaffaCakes118
-
Size
24KB
-
Sample
240428-p2r2qsgb73
-
MD5
053aaab62e8b79a398c655ac0834266e
-
SHA1
f8c104b21b30205d2f01da8b9414b419fa3f3b6d
-
SHA256
040d2a867b810e66ba577377c79391aca97401e0a9dd7253143838195bf05698
-
SHA512
61f49b177826c2e2ba3fb3c0d2d03717911be904adcd4b6edff9246fa63c6e2b98bbcc5438f3faa4ccdfc441f4abcd2908a6c8886ac9b118066b2cbadd13f79c
-
SSDEEP
384:Jd5RkvCxSQEqj9SGBtUaYGIq9Y02aY/JM:JLRkvrQEjGBtIan
Static task
static1
Behavioral task
behavioral1
Sample
053aaab62e8b79a398c655ac0834266e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
053aaab62e8b79a398c655ac0834266e_JaffaCakes118.html
Resource
win10v2004-20240419-en
Malware Config
Extracted
http://74.208.13.22/csf/hta.html
Extracted
http://74.208.13.22/csf/rl8.jpg
Targets
-
-
Target
053aaab62e8b79a398c655ac0834266e_JaffaCakes118
-
Size
24KB
-
MD5
053aaab62e8b79a398c655ac0834266e
-
SHA1
f8c104b21b30205d2f01da8b9414b419fa3f3b6d
-
SHA256
040d2a867b810e66ba577377c79391aca97401e0a9dd7253143838195bf05698
-
SHA512
61f49b177826c2e2ba3fb3c0d2d03717911be904adcd4b6edff9246fa63c6e2b98bbcc5438f3faa4ccdfc441f4abcd2908a6c8886ac9b118066b2cbadd13f79c
-
SSDEEP
384:Jd5RkvCxSQEqj9SGBtUaYGIq9Y02aY/JM:JLRkvrQEjGBtIan
Score10/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-