General

  • Target

    4c48175a44d89ef8d6c92b8473eba6a6_JaffaCakes118

  • Size

    5.2MB

  • MD5

    4c48175a44d89ef8d6c92b8473eba6a6

  • SHA1

    de0541f008f9e606f799069d90d9f3ebd9d1a70d

  • SHA256

    d482d7e39076ad62091622475baa816ca68e88f144253e42a9cdf42fe6473fa5

  • SHA512

    ecf4d3cc409654e17c9d1d4c142ce14ee52630a7715663049899e37a6528c65294e5df41bd3d567d8e4887375a700ca3916469a38ffe85dfada03cffac878d7e

  • SSDEEP

    98304:RK6MK+15ZA/wFkzThIeqpxRpJHXOAd2QNXZTIpKskI5XzCh6XcY2R9tR:RK6yZhkhI7pJH+MRhIgsJGh6XWRTR

Score
10/10

Malware Config

Extracted

Family

webmonitor

C2

kamilw1337.wm01.to:443

Attributes
  • config_key

    a72oDI537AbYRjeItTOo34O25nOyaPFK

  • private_key

    MqUzv9esY

  • url_path

    /recv5.php

Signatures

  • WebMonitor payload 1 IoCs
  • Webmonitor family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • 4c48175a44d89ef8d6c92b8473eba6a6_JaffaCakes118
    .rar
  • Extreme Injector v3.7.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • Extreme Injector v3.rar
    .rar
  • Extreme Injector v3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Instrukcja.txt
  • settings.xml
  • xariesgang3.lua
  • xyoungsokin.dll
    .dll windows:6 windows x64 arch:x64

    94c8d17143f183155ef6aa5c56cbf0e9


    Headers

    Imports

    Sections