Overview
overview
10Static
static
314591d9910...18.exe
windows7-x64
1014591d9910...18.exe
windows10-2004-x64
7$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$TEMP/dracone.dll
windows7-x64
1$TEMP/dracone.dll
windows10-2004-x64
1General
-
Target
14591d9910e624ab16feea7ed087fabf_JaffaCakes118
-
Size
346KB
-
Sample
240504-y7ywxadd35
-
MD5
14591d9910e624ab16feea7ed087fabf
-
SHA1
7526af35505b214ea6c55ae68cf3b00242b2bb67
-
SHA256
54dfc63b3e6e5cc56ffc01ba5c56ec6018886d3eac87f596ef378fbeebcf13f2
-
SHA512
c8c50a3a1f43861c19912208dcf7c06b69aaf4ccf997bba9a3545f44a11fae11fa3bf0cc671b430e7320eb44dcf6cbb97b22665c6f87c374b8d6d2b9cbe9e8fd
-
SSDEEP
6144:S58x3qwSG7IXDf20O1L/URmBzpBW9OIFRft/BHK93td/2yGm0a+ogV8gQmiE:Nx3q1mo7c1L/UArW93FRFZHW3DdJe4mX
Static task
static1
Behavioral task
behavioral1
Sample
14591d9910e624ab16feea7ed087fabf_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
14591d9910e624ab16feea7ed087fabf_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Splash.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Splash.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$TEMP/dracone.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$TEMP/dracone.dll
Resource
win10v2004-20240419-en
Malware Config
Extracted
formbook
3.9
di
rhinogram.win
flood-web.com
xedienvinfast.tech
loansed.com
490xtt.info
jackfrischonline.com
pewarisservices.com
fylmz.com
kimclarkephotography.com
robertmaier.net
sergiogabrielfarias.com
luxurybedroomfurniture.com
rehobothtoday.net
mihealthconsulting.com
20lovesongsalbums.com
zipformoniline.com
lifan-parts.com
notitanswin.com
timsmowersandmore.com
upskillify.com
beazleandbuford.com
tegreens.com
brilliantmondays.com
hotelshalombahia.com
calts.net
fadaxcl.com
itsamesmerizinglife.com
mlregan.com
erkenbosalmayionlemek.com
enterprisingcontractor.com
soneo-audio.com
ennegrocontraasviolencias.gal
magicalbitcoinz.com
mafse.info
viotravel.net
myshareiff.com
biozz.win
instantown.com
jprerror404.online
alphadepo.net
zenesammy.com
girisdopingbet1.com
2016airmaxshop.com
bcdedajf.com
za1four.loan
gokkusagiengelligazetesi.com
mbq0eau56oy89.loan
nxx.ink
zoeksupport02.com
modern-minimalist.com
rivers.wine
sharedstorytelling.com
cre8tivsolution.com
sssav62621.com
compare-print.com
q9355.com
smartindia.club
winstonconeoptics.com
cdjksjj.com
conservadonovinho.com
ajaoko.online
thestockchasers.com
startails.com
secumoni.com
oyishu.com
Targets
-
-
Target
14591d9910e624ab16feea7ed087fabf_JaffaCakes118
-
Size
346KB
-
MD5
14591d9910e624ab16feea7ed087fabf
-
SHA1
7526af35505b214ea6c55ae68cf3b00242b2bb67
-
SHA256
54dfc63b3e6e5cc56ffc01ba5c56ec6018886d3eac87f596ef378fbeebcf13f2
-
SHA512
c8c50a3a1f43861c19912208dcf7c06b69aaf4ccf997bba9a3545f44a11fae11fa3bf0cc671b430e7320eb44dcf6cbb97b22665c6f87c374b8d6d2b9cbe9e8fd
-
SSDEEP
6144:S58x3qwSG7IXDf20O1L/URmBzpBW9OIFRft/BHK93td/2yGm0a+ogV8gQmiE:Nx3q1mo7c1L/UArW93FRFZHW3DdJe4mX
-
Formbook payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/Splash.dll
-
Size
4KB
-
MD5
3f35f73787f0c3bb5e59445fb18ade0d
-
SHA1
f1566faff96c3988cfc28dc7d433094b6348cdbf
-
SHA256
5570969d22a33c23b60c5f5536f781219e458a869b77b8dde4a94cc124ee4de6
-
SHA512
45c42ea95f53a3b8a3fd74bd55ad6f0b3f2b91dd969104de845fd819fe307dec2b4d472bee45554500b0c51052ee82ac98196e894af806edf67a947328474e57
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
fbe295e5a1acfbd0a6271898f885fe6a
-
SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da
-
SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
-
SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
SSDEEP
192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
Score3/10 -
-
-
Target
$PLUGINSDIR/UserInfo.dll
-
Size
4KB
-
MD5
7836f464ae0102452e94a363b491b759
-
SHA1
59909a48448b99e2eb9cd336d81d60764da59f31
-
SHA256
11adf8916947b5a20a071b494fa034cf62769dcc6293a1340b29a5bb29ac8e87
-
SHA512
5ed63eefa1b3b3caad4cb762ccb8419c05bcad3da3a7415235cda2d2a1f79eb018503ca30a0a92d6b72160327decea9a70c48e0c28de94dd67303d4aea4a02db
Score3/10 -
-
-
Target
$TEMP/dracone.dll
-
Size
34KB
-
MD5
9efcdaec062823e9749250da225dfe4d
-
SHA1
1d6209a71c061729683ce81890f2d8c0c02c6e05
-
SHA256
04904de1d15bb931cf85eadb7714bd53f7236de0fbc1f62c22aafb3470ff847c
-
SHA512
b7faee0a4c769ee39fc11fe20c6ec362b6802e9fd7f81d8a495f1423263af8074cf995c1ff8d964680c10c3026e69ddb66e749b9b29784309502d805673a720a
-
SSDEEP
768:tyxfTX4H2MoxHO1iB94vJfIhdV2GLkBrNj2+QE8u8VP:sfTX4zo85w+pa+J8f
Score1/10 -