General
-
Target
5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118
-
Size
918KB
-
Sample
240520-dsxp3shb58
-
MD5
5ce8ca2c99161818ce9f4444da82887f
-
SHA1
5c04d36d4700de9ab5f16d8e4ae8b73b01d5a984
-
SHA256
8b08e73ad310f5e7e06c78b453ff8bc00851d0b9f86fa00c64a3dd42ec1632ce
-
SHA512
475eba06a17037f9258417cfe553359b21d4248a1d6b64c8c603684eee8851ef92d81c1bd2145350fc015673f1d1b4bf5a5b4a1fc2c7b7fc055e66cf73c5ede6
-
SSDEEP
6144:f3bDksaZLLP8OvtzpfzzlPFAAfwG44X0m+Z1Af61g8nKB17M1hRJG:fvksaZLwOvTzRP6Af44ajACi8Kr7M1g
Static task
static1
Behavioral task
behavioral1
Sample
5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
qakbot
325.43
abc003
1600093841
134.0.196.46:995
187.200.69.215:443
66.222.88.126:995
151.73.125.102:443
186.94.248.208:2078
71.56.53.127:443
87.65.204.240:995
63.155.74.135:995
68.184.45.73:443
82.77.105.236:2222
23.240.70.80:443
24.138.77.61:443
76.111.128.194:443
75.136.40.155:443
75.182.214.87:443
73.216.60.90:2222
148.240.52.146:443
108.185.113.12:443
216.163.4.136:443
66.215.32.224:443
35.134.202.234:443
84.247.55.190:443
77.159.149.74:443
72.204.242.138:32102
24.27.82.216:2222
207.255.161.8:465
206.183.190.53:993
134.228.24.29:443
96.41.93.96:443
84.232.238.30:443
184.98.103.204:995
72.186.1.237:443
81.133.234.36:2222
189.163.185.110:443
71.84.5.114:995
68.225.56.31:443
108.178.66.82:995
172.87.134.226:443
216.201.162.158:443
67.6.55.77:443
76.170.77.99:995
94.53.92.42:443
74.195.88.59:995
64.121.114.87:443
166.62.180.194:2078
209.182.122.217:443
189.150.107.132:443
72.240.200.181:2222
73.32.115.251:443
72.223.123.155:443
75.90.53.37:443
205.178.7.90:443
187.213.52.174:995
45.32.155.12:443
76.179.54.116:443
71.187.170.235:443
69.167.206.238:50001
207.255.161.8:2078
207.255.161.8:32100
31.5.21.66:443
178.222.113.168:995
86.162.13.18:2222
71.126.139.251:443
100.1.39.62:443
5.13.144.137:995
67.165.206.193:993
50.244.112.10:995
72.204.242.138:465
47.44.217.98:443
72.36.59.46:2222
2.90.87.34:995
213.120.109.73:2222
47.146.32.175:443
176.223.8.159:2222
69.11.247.242:443
75.81.25.223:443
50.232.172.114:443
184.180.157.203:2222
190.30.187.34:443
96.18.240.158:443
37.210.186.213:61201
75.136.26.147:443
96.255.188.58:443
207.255.161.8:993
173.26.189.151:443
70.123.92.175:2222
72.82.15.220:443
108.46.145.30:443
5.15.29.67:443
74.75.237.11:443
68.174.15.223:443
156.213.179.139:443
199.247.22.145:443
188.51.33.232:995
50.244.112.106:443
94.59.227.197:995
47.28.131.209:443
118.167.118.227:443
71.182.142.63:443
141.158.47.123:443
72.204.242.138:990
80.14.209.42:2222
208.93.202.49:443
41.228.24.11:443
72.179.13.59:443
24.187.59.203:2222
24.37.178.158:443
50.104.68.223:443
5.12.0.239:443
173.245.152.231:443
72.214.55.195:995
66.57.216.53:993
189.231.196.236:443
67.209.195.198:443
24.231.54.185:2222
98.240.24.57:443
207.255.161.8:995
86.98.89.62:2222
217.165.164.132:2222
51.223.158.125:443
45.77.193.83:443
207.246.75.201:443
95.179.247.224:443
199.247.16.80:443
73.228.1.246:443
24.229.150.54:995
209.137.209.163:995
45.32.154.10:443
5.193.181.221:2078
41.232.231.135:995
148.101.68.96:443
190.85.91.154:443
144.139.47.206:443
72.190.101.70:443
80.195.103.146:2222
2.91.109.154:995
95.77.144.238:443
47.180.66.10:443
77.27.174.49:995
195.162.106.93:2222
190.220.8.10:443
191.84.7.1:443
5.234.221.88:995
117.218.208.239:443
84.117.176.32:443
73.227.232.166:443
96.30.198.161:443
47.146.169.85:443
46.53.26.66:443
72.204.242.138:20
Targets
-
-
Target
5ce8ca2c99161818ce9f4444da82887f_JaffaCakes118
-
Size
918KB
-
MD5
5ce8ca2c99161818ce9f4444da82887f
-
SHA1
5c04d36d4700de9ab5f16d8e4ae8b73b01d5a984
-
SHA256
8b08e73ad310f5e7e06c78b453ff8bc00851d0b9f86fa00c64a3dd42ec1632ce
-
SHA512
475eba06a17037f9258417cfe553359b21d4248a1d6b64c8c603684eee8851ef92d81c1bd2145350fc015673f1d1b4bf5a5b4a1fc2c7b7fc055e66cf73c5ede6
-
SSDEEP
6144:f3bDksaZLLP8OvtzpfzzlPFAAfwG44X0m+Z1Af61g8nKB17M1hRJG:fvksaZLwOvTzRP6Af44ajACi8Kr7M1g
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-