General
-
Target
311c81f0ac007acf327335c85620ca01_JaffaCakes118
-
Size
391KB
-
Sample
240510-z9xx3aae3w
-
MD5
311c81f0ac007acf327335c85620ca01
-
SHA1
5c442e95ddb5ca6c2b2f056d41f0bdf19a16b67c
-
SHA256
39da070a2696c9deb1da934d7833f37fab41c92b370eddc1970c726935b8d467
-
SHA512
8b010c61e0efcf4c4ed545a633b2c9b66fec45cd908924738d4e44e4c2042309a0cde26afe7cc47b9cd4c4eaa64a27fd285ba3c110e959e9a863700674b60975
-
SSDEEP
6144:uxCFpvb7oAiyO37HGOcSdIZPk+2wSdyxXgj7vvzWBcYlrcUk+QAVUZhBqP:nFtbUVDHuEePkPqxXaSBFdk+3qL
Static task
static1
Behavioral task
behavioral1
Sample
311c81f0ac007acf327335c85620ca01_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
311c81f0ac007acf327335c85620ca01_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
lokibot
http://blazinghotter.igg.biz/cgi/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
311c81f0ac007acf327335c85620ca01_JaffaCakes118
-
Size
391KB
-
MD5
311c81f0ac007acf327335c85620ca01
-
SHA1
5c442e95ddb5ca6c2b2f056d41f0bdf19a16b67c
-
SHA256
39da070a2696c9deb1da934d7833f37fab41c92b370eddc1970c726935b8d467
-
SHA512
8b010c61e0efcf4c4ed545a633b2c9b66fec45cd908924738d4e44e4c2042309a0cde26afe7cc47b9cd4c4eaa64a27fd285ba3c110e959e9a863700674b60975
-
SSDEEP
6144:uxCFpvb7oAiyO37HGOcSdIZPk+2wSdyxXgj7vvzWBcYlrcUk+QAVUZhBqP:nFtbUVDHuEePkPqxXaSBFdk+3qL
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-