General
-
Target
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118
-
Size
493KB
-
Sample
240511-kxmt1ada59
-
MD5
33ca486ee889bc38d992e033ea20cb5a
-
SHA1
c26e975dbc222bfdd9a7fd628c9a76d5fb9ed2ec
-
SHA256
d01d56d0488f4286f99b67ea683b80cb85cb1a1740aa92470c3b2466f0ea207a
-
SHA512
7f9055d413103fb0d33383c915fe39d5880fb3c2bc77d2de232388d89cc0d45d865c446a6cee06472863d0b0b70fa431ca217e0a36e1191160864d12c3c8adb2
-
SSDEEP
12288:zZUvZhblII/vlJEzfYT7a19RKXHMyv+A9:zINlIAJM+7mzKbmM
Static task
static1
Behavioral task
behavioral1
Sample
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps1
Resource
win10v2004-20240426-en
Malware Config
Extracted
lokibot
https://afrisoccer.co.tz/cgi/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118
-
Size
493KB
-
MD5
33ca486ee889bc38d992e033ea20cb5a
-
SHA1
c26e975dbc222bfdd9a7fd628c9a76d5fb9ed2ec
-
SHA256
d01d56d0488f4286f99b67ea683b80cb85cb1a1740aa92470c3b2466f0ea207a
-
SHA512
7f9055d413103fb0d33383c915fe39d5880fb3c2bc77d2de232388d89cc0d45d865c446a6cee06472863d0b0b70fa431ca217e0a36e1191160864d12c3c8adb2
-
SSDEEP
12288:zZUvZhblII/vlJEzfYT7a19RKXHMyv+A9:zINlIAJM+7mzKbmM
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-