Overview
overview
10Static
static
330792d175b...18.exe
windows7-x64
1030792d175b...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3General
-
Target
30792d175bc0315e919a938faeeba246_JaffaCakes118
-
Size
217KB
-
Sample
240510-w8brnabc9v
-
MD5
30792d175bc0315e919a938faeeba246
-
SHA1
0b0c1a80ec9a3774d7528a7a825e1921b193e50d
-
SHA256
f81955d71f3b6bda792886a815e36fee54ab72b51e45c02533f3f7f1c9e9c7a0
-
SHA512
44cbb7cfdd156f51c1273c0372f2b7d77e0bdf26314ddb1fa19289610f42cbadff687a869bbb6d10e06187a4ac00dd5b2603288d2b2bbd88d97e5cbacf55b042
-
SSDEEP
6144:0puBTenKuodNDiytQydV8bF8Nax8FL1D55q:DBTeKu69rPdV8F9OLJ55q
Static task
static1
Behavioral task
behavioral1
Sample
30792d175bc0315e919a938faeeba246_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30792d175bc0315e919a938faeeba246_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
uninst.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240426-en
Malware Config
Extracted
lokibot
http://whopetithelp.ru/crystal/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
30792d175bc0315e919a938faeeba246_JaffaCakes118
-
Size
217KB
-
MD5
30792d175bc0315e919a938faeeba246
-
SHA1
0b0c1a80ec9a3774d7528a7a825e1921b193e50d
-
SHA256
f81955d71f3b6bda792886a815e36fee54ab72b51e45c02533f3f7f1c9e9c7a0
-
SHA512
44cbb7cfdd156f51c1273c0372f2b7d77e0bdf26314ddb1fa19289610f42cbadff687a869bbb6d10e06187a4ac00dd5b2603288d2b2bbd88d97e5cbacf55b042
-
SSDEEP
6144:0puBTenKuodNDiytQydV8bF8Nax8FL1D55q:DBTeKu69rPdV8F9OLJ55q
Score10/10-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
3e277798b9d8f48806fbb5ebfd4990db
-
SHA1
d1ab343c5792bc99599ec7acba506e8ba7e05969
-
SHA256
fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
-
SHA512
84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92
-
SSDEEP
192:d4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjsK72dwF7dBOne:Wn3T5KdHCMRD/R1cOnrjs+BO
Score3/10 -
-
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
b26b412d9f1050ad53f663c972fdcd9f
-
SHA1
7bc4ed444f3f8fd14c2c36784d828175bace8c17
-
SHA256
70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
-
SHA512
ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
-
SSDEEP
48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
Score3/10 -
-
-
Target
$PLUGINSDIR/StartMenu.dll
-
Size
7KB
-
MD5
12281b59f907027f4d374b8423e2b0f9
-
SHA1
21216630633bb6cc4aa9b1c5873f345bbe06b74c
-
SHA256
1cc68f4aef76d70d7326853f0e604ff3ac926c1dfe7aee7ad69a3259280a4e66
-
SHA512
7c8c7a5c7f8e6d7a0b5d54ad1bfc34831358487985bd64459cd22f45f82385f4740e7a62048b01759b79e3d0f05ccb8152d63c3d864f308146ce5c746a9296b6
-
SSDEEP
96:qgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tR3hhEl7y:qgiqVPgK8K9eIdE9B/tVhg7
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae
-
SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b
-
SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
-
SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
-
SSDEEP
192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score3/10 -
-
-
Target
uninst.exe
-
Size
64KB
-
MD5
96910c8a8d4b7ede90a59c90d105c511
-
SHA1
413e570bcb74495a7d4dd8b96ab64aef381ee876
-
SHA256
8c3f7744fbc3b8280a578436a1c58eb12308d58285ae554ffed9e38c3742126f
-
SHA512
4a7308a754b8c137f24475785b00b00ff8705cfe795a17fadec4fff3f472bd53d177e85bae09e6b3799b7c35a5365b122c1f1517dfc22b1b5f73453474e37a14
-
SSDEEP
1536:5aLuXE8XPIYyr7jvN0DoJ+cGgdLeAyNxnrz2/a6Bb:0LuXzXwYyr6DoocGceAy3ua6Bb
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
b26b412d9f1050ad53f663c972fdcd9f
-
SHA1
7bc4ed444f3f8fd14c2c36784d828175bace8c17
-
SHA256
70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
-
SHA512
ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
-
SSDEEP
48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
Score3/10 -