General
-
Target
20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118
-
Size
221KB
-
Sample
240507-swclmsda2v
-
MD5
20efcddcbdd32c1b9648a4d50d2a29bb
-
SHA1
b36284f8d8f3a193ef9f0aa2465eee0deca99d94
-
SHA256
fd1e4ecef5aed84a1e9cf04271111c5041d6c50c850b75959932927cf875293a
-
SHA512
067da669c2d212537426a4027cfb326216c5fb31f4e2cbbc881dc0a6cf99688a303b076b9256f87243d75b19b73ac475400c4a30da8aa6bacce66bd2c59ca8a4
-
SSDEEP
6144:afb0rHntqUtSsDWXjU5YVFsWfefYwd8h:hksDMjU5YVaWkd
Behavioral task
behavioral1
Sample
20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118.exe
Resource
win7-20240419-en
Malware Config
Extracted
qakbot
324.70
spx85
1585321881
201.152.111.104:995
181.197.195.138:995
96.35.170.82:2222
50.244.112.10:443
174.126.230.25:443
74.33.70.220:443
72.80.137.215:443
86.121.120.255:443
108.190.151.108:2222
70.166.158.118:443
24.229.245.124:995
71.187.170.235:443
49.191.6.183:995
71.80.45.253:443
46.214.62.199:443
76.107.242.174:443
79.116.229.1:995
31.5.172.53:443
71.172.110.236:443
94.98.82.131:443
73.60.148.209:443
104.235.125.137:443
188.27.27.227:443
97.78.107.14:443
188.26.131.41:443
174.104.23.7:443
47.39.76.74:443
98.27.176.35:443
104.34.122.18:443
104.174.71.153:2222
89.34.231.30:443
173.69.58.179:443
24.184.5.251:2222
79.113.116.216:443
81.245.66.237:995
98.219.77.197:443
207.255.18.67:443
78.97.116.41:443
100.1.239.189:443
208.93.202.49:443
173.63.217.48:443
206.169.163.147:995
73.226.220.56:443
71.197.126.250:443
70.37.212.176:995
72.142.106.198:465
98.190.24.81:443
187.194.16.208:2222
68.116.193.239:443
93.114.89.119:995
85.204.189.105:443
173.173.68.41:443
137.119.71.87:443
24.110.14.40:443
187.19.151.218:995
100.4.185.8:443
72.36.59.46:2222
5.2.149.216:443
83.25.14.84:2222
173.173.1.164:443
72.36.11.22:443
78.97.145.242:443
75.110.250.89:443
190.204.58.240:2078
24.55.152.50:995
46.214.86.45:443
47.202.98.230:443
159.242.41.235:443
70.57.15.187:993
74.105.139.160:443
24.46.40.189:2222
100.38.123.22:443
24.186.50.78:443
67.7.2.109:2222
71.220.222.169:443
72.190.124.29:443
72.218.167.183:995
72.16.212.107:465
173.3.132.17:995
72.190.101.70:443
104.152.16.45:995
70.62.160.186:6883
98.116.62.242:443
74.129.26.223:443
24.201.79.208:2078
85.7.22.186:2222
79.119.74.176:443
67.251.155.12:443
12.5.37.3:443
89.43.208.246:443
78.96.148.177:443
73.169.47.57:443
45.247.216.164:443
24.110.96.149:443
98.118.156.172:443
46.153.111.112:995
184.176.139.8:443
88.158.200.203:443
172.95.42.35:443
86.126.197.176:443
67.165.206.193:995
79.127.79.210:995
73.23.194.75:443
206.255.163.120:443
74.109.200.208:443
65.30.12.240:443
100.40.48.96:443
84.247.55.190:443
89.137.162.193:443
94.59.237.62:995
75.111.145.5:443
68.174.15.223:443
71.182.142.63:443
64.19.74.29:995
63.155.135.211:995
75.82.228.209:443
69.246.151.5:443
47.153.115.154:993
71.77.252.14:2222
24.37.178.158:443
209.213.30.152:443
97.81.255.189:443
72.29.181.77:2078
73.76.47.127:443
47.39.177.171:2222
82.77.166.92:443
95.77.237.115:443
76.23.204.29:443
68.49.120.179:443
98.213.28.175:443
50.244.112.106:443
86.125.180.36:995
72.255.200.129:2222
47.180.66.10:443
72.209.191.27:443
99.229.5.63:995
184.180.157.203:2222
70.191.103.164:443
71.193.126.206:443
5.13.94.54:443
148.75.231.53:443
74.75.237.11:443
181.126.86.223:443
71.226.90.153:443
68.225.250.136:443
75.183.171.155:3389
98.164.253.75:443
50.115.187.139:443
137.99.224.198:443
66.26.160.37:443
Targets
-
-
Target
20efcddcbdd32c1b9648a4d50d2a29bb_JaffaCakes118
-
Size
221KB
-
MD5
20efcddcbdd32c1b9648a4d50d2a29bb
-
SHA1
b36284f8d8f3a193ef9f0aa2465eee0deca99d94
-
SHA256
fd1e4ecef5aed84a1e9cf04271111c5041d6c50c850b75959932927cf875293a
-
SHA512
067da669c2d212537426a4027cfb326216c5fb31f4e2cbbc881dc0a6cf99688a303b076b9256f87243d75b19b73ac475400c4a30da8aa6bacce66bd2c59ca8a4
-
SSDEEP
6144:afb0rHntqUtSsDWXjU5YVFsWfefYwd8h:hksDMjU5YVaWkd
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-