General
-
Target
218327da4a1a070de03b9c07cae4abc3_JaffaCakes118
-
Size
1.1MB
-
Sample
240507-yrmtpsfg78
-
MD5
218327da4a1a070de03b9c07cae4abc3
-
SHA1
b42245b80511b5600df1d5ddea40fce78674fba5
-
SHA256
b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50
-
SHA512
dc1f00d8a16eefcdaa896106a01702e9d13a18d532733b4f8edffbe57ebd98a790c1b51c7eefff3e6b5ea8927691649c536a72f1cc0ff1630ae642184049ef5c
-
SSDEEP
6144:1Ug69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kr:y99trKTX84bkQfUO/aQdeMo3e+k4jAC8
Static task
static1
Behavioral task
behavioral1
Sample
218327da4a1a070de03b9c07cae4abc3_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
qakbot
325.43
abc005
1600415827
50.244.112.10:995
207.237.1.152:443
184.97.148.2:443
207.255.161.8:993
69.167.206.238:50001
72.36.59.46:2222
173.26.189.151:443
2.50.59.177:443
217.162.149.212:443
199.247.22.145:443
203.106.195.67:443
109.154.214.224:2222
117.199.14.31:443
175.211.225.118:443
188.51.33.232:995
50.244.112.106:443
65.30.213.13:6882
24.37.178.158:443
47.28.131.209:443
207.255.161.8:995
141.158.47.123:443
72.204.242.138:990
188.25.244.220:443
46.248.56.248:995
2.7.65.32:2222
202.141.244.118:995
98.16.204.189:995
189.231.196.236:443
2.91.73.105:995
81.133.234.36:2222
98.121.187.78:443
84.117.176.32:443
24.205.42.241:443
50.104.68.223:443
213.31.203.48:2222
188.210.225.179:443
209.137.209.163:995
36.77.151.211:443
95.77.223.148:443
207.246.75.201:443
45.77.193.83:443
45.32.154.10:443
59.26.204.144:443
67.170.137.8:443
80.195.103.146:2222
65.131.41.15:995
72.190.101.70:443
24.53.49.240:2222
5.12.0.239:443
96.237.141.134:995
37.210.186.213:61201
98.26.50.62:995
173.245.152.231:443
78.96.199.79:443
74.56.167.31:443
199.116.241.147:443
94.52.68.72:443
96.30.198.161:443
95.179.247.224:443
108.5.34.248:443
199.247.16.80:443
24.231.54.185:2222
92.59.35.196:2222
110.159.189.54:443
72.204.242.138:20
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
72.204.242.138:53
69.123.116.167:2222
93.113.177.152:443
68.46.142.48:995
47.146.169.85:443
79.118.120.51:2222
74.75.216.202:443
173.22.125.129:2222
200.75.136.78:443
80.14.209.42:2222
84.78.128.76:2222
86.122.241.39:2222
72.209.191.27:443
185.246.9.69:995
71.221.92.98:443
71.12.214.209:2222
80.240.26.178:443
108.30.125.94:443
190.85.91.154:443
67.60.113.253:2222
75.87.161.32:995
203.198.96.200:443
71.197.126.250:443
66.222.88.126:995
47.146.32.175:443
200.124.231.21:443
24.201.79.208:2078
24.234.86.201:995
73.228.1.246:443
172.78.30.215:443
2.90.109.29:995
134.0.196.46:995
178.222.113.168:995
77.159.149.74:443
41.44.218.243:995
95.76.109.181:443
39.36.105.140:995
188.247.252.243:443
72.82.15.220:443
166.62.180.194:2078
103.76.160.110:443
103.110.49.88:443
70.124.29.226:443
2.50.112.11:20
47.44.217.98:443
216.201.162.158:443
89.42.142.35:443
71.126.139.251:443
71.84.5.114:995
108.178.66.82:995
134.228.24.29:443
76.170.77.99:995
184.98.103.204:995
108.185.113.12:443
96.41.93.96:443
216.163.4.136:443
96.18.240.158:443
66.215.32.224:443
35.134.202.234:443
181.91.255.26:443
117.218.208.239:443
72.204.242.138:32102
144.139.47.206:443
207.255.161.8:465
45.32.155.12:443
59.99.37.23:443
66.208.105.6:443
71.187.170.235:443
68.174.15.223:443
207.255.161.8:32100
207.255.161.8:2078
98.22.65.76:443
68.174.9.179:443
67.165.206.193:993
72.204.242.138:465
107.77.236.109:0
69.11.247.242:443
75.81.25.223:443
207.255.18.67:443
103.206.112.234:443
50.232.172.114:443
75.136.40.155:443
Targets
-
-
Target
218327da4a1a070de03b9c07cae4abc3_JaffaCakes118
-
Size
1.1MB
-
MD5
218327da4a1a070de03b9c07cae4abc3
-
SHA1
b42245b80511b5600df1d5ddea40fce78674fba5
-
SHA256
b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50
-
SHA512
dc1f00d8a16eefcdaa896106a01702e9d13a18d532733b4f8edffbe57ebd98a790c1b51c7eefff3e6b5ea8927691649c536a72f1cc0ff1630ae642184049ef5c
-
SSDEEP
6144:1Ug69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kr:y99trKTX84bkQfUO/aQdeMo3e+k4jAC8
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-