General
-
Target
1172996f92030f921568ba8643650c69_JaffaCakes118
-
Size
1.6MB
-
Sample
240504-erblwsfg69
-
MD5
1172996f92030f921568ba8643650c69
-
SHA1
ec361a03f9b0095dd92a29ef2794c0124c11361a
-
SHA256
33cce03d34bb9b8d014d5c7f640c4bd57d9c7fc4ae1f663447bc044ae8b6d17d
-
SHA512
4537eeec7ebd8dbef8feb3441a3bcddd89f74e88ea020e845085d1f19f25b654bfef4574ad283702edccfc9f055879e1dcdc2c622400025f30246b2489890214
-
SSDEEP
24576:9QWn8RZz/gMbER12GT3OcQcGfjeHi7YmJXFsoPvWZ:9YRZDgqER12GT3OcQcGbeHE5Fso3W
Behavioral task
behavioral1
Sample
1172996f92030f921568ba8643650c69_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
lokibot
http://151.80.3.78/2/300/cat.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
1172996f92030f921568ba8643650c69_JaffaCakes118
-
Size
1.6MB
-
MD5
1172996f92030f921568ba8643650c69
-
SHA1
ec361a03f9b0095dd92a29ef2794c0124c11361a
-
SHA256
33cce03d34bb9b8d014d5c7f640c4bd57d9c7fc4ae1f663447bc044ae8b6d17d
-
SHA512
4537eeec7ebd8dbef8feb3441a3bcddd89f74e88ea020e845085d1f19f25b654bfef4574ad283702edccfc9f055879e1dcdc2c622400025f30246b2489890214
-
SSDEEP
24576:9QWn8RZz/gMbER12GT3OcQcGfjeHi7YmJXFsoPvWZ:9YRZDgqER12GT3OcQcGbeHE5Fso3W
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-