Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
19-05-2024 09:28
General
-
Target
59b3c322d96ea9484bba43e7271b8a07_JaffaCakes118.exe
-
Size
176KB
-
MD5
59b3c322d96ea9484bba43e7271b8a07
-
SHA1
7c701e74728bd495d8b3ee4c2c478b76c4c93349
-
SHA256
7a1f440b6b21b1ddd98c2c6eb495910ad91d8097114348fbb24bb323676cb383
-
SHA512
be6842e5ed751f6eb7a22ef9247d23bddd5594aebc45ea2f3bfd744060c684d391afbfdc3ef26c58452e5a2ccd0baa2ab16ecd044568c635a578821d206a1e98
-
SSDEEP
3072:aPKgZsYU009yEesYZfIeIXn8DBNiAHRDmm5mNWg8e6:lgZsYU009yEW7o8DOAHRDmm5msgS
Score
10/10
Malware Config
Extracted
Family
icedid
Botnet
1163895564
C2
aginia.net
aginia.top
aginia.in
aginia.tel
telected.com
telected.xyz
Attributes
-
auth_var
4
-
url_path
/index.php
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
IcedID Second Stage Loader 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b3c322d96ea9484bba43e7271b8a07_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\59b3c322d96ea9484bba43e7271b8a07_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
180KB