Overview
overview
10Static
static
31b023b6f6a...18.exe
windows7-x64
101b023b6f6a...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$TEMP/shwa.dll
windows7-x64
3$TEMP/shwa.dll
windows10-2004-x64
3General
-
Target
1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118
-
Size
344KB
-
Sample
240506-gbedysba9x
-
MD5
1b023b6f6a4447cd8c2d8e841f542227
-
SHA1
397af11ba7d160ab76f3099798257c057790280a
-
SHA256
465e437108d6f904ff77ea9a39df2e764449efeb2100c79fbba6cb092b0d3633
-
SHA512
3326329715fc325a712607b59204a17ec1f8d19868fc644ec1fe282b5c5e40577faff17c372e1c2ab885a9f37d96e09afee4e5ca27b424f3e10140b1b7cd8150
-
SSDEEP
6144:fWNdxridQv5Rzh+uSrEga5GJvh4BTFWSPEhaxso8zM2bGgWzRXEGPLyhq9rf7qu5:udxed4guKEge2vh4BTFWwCo0M2bEzRXn
Static task
static1
Behavioral task
behavioral1
Sample
1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$TEMP/shwa.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/shwa.dll
Resource
win10v2004-20240419-en
Malware Config
Extracted
lokibot
http://kamatecpark.com/~zadmin/lmark/emma/link.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118
-
Size
344KB
-
MD5
1b023b6f6a4447cd8c2d8e841f542227
-
SHA1
397af11ba7d160ab76f3099798257c057790280a
-
SHA256
465e437108d6f904ff77ea9a39df2e764449efeb2100c79fbba6cb092b0d3633
-
SHA512
3326329715fc325a712607b59204a17ec1f8d19868fc644ec1fe282b5c5e40577faff17c372e1c2ab885a9f37d96e09afee4e5ca27b424f3e10140b1b7cd8150
-
SSDEEP
6144:fWNdxridQv5Rzh+uSrEga5GJvh4BTFWSPEhaxso8zM2bGgWzRXEGPLyhq9rf7qu5:udxed4guKEge2vh4BTFWwCo0M2bEzRXn
Score10/10-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
fbe295e5a1acfbd0a6271898f885fe6a
-
SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da
-
SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
-
SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
SSDEEP
192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
ab101f38562c8545a641e95172c354b4
-
SHA1
ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
-
SHA256
3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
-
SHA512
72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037
-
SSDEEP
96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE
Score3/10 -
-
-
Target
$TEMP/shwa.dll
-
Size
23KB
-
MD5
e9f0406091c6e24979d02df7e6af742c
-
SHA1
2962e5b0043d6bcd777be53877fba3e6ade3dbe5
-
SHA256
a134f9624f6f880bfd2ba5b242e519961af92de5d22733892fe2373e0083ffd4
-
SHA512
45db0bce7c6f165fa15597d70e7da7abff0cb0e824a44f2516809157177ca7ccda0ddd0e2c74ba10be657be94700bb9d2ad81399143be94166802590ce74f5d2
-
SSDEEP
384:zUOLqD8OaFumDTsk2MjMdoShZrmunRyjEuG+CB+rA390dRYvo2Udpufhb7z0:zUO2DvYuKTskFQvf5UjEuvC132YvMufO
Score3/10 -