General
-
Target
5d568a9de60d5265370f58305f1d942d_JaffaCakes118
-
Size
400KB
-
Sample
240520-ftks1sdf8t
-
MD5
5d568a9de60d5265370f58305f1d942d
-
SHA1
b249a7bbda785a1194c6a40699439a639a806521
-
SHA256
767bfbc1a25997de2d6203b7ec79afe012f1049eda612efb5c51e4da68972b58
-
SHA512
0e80dbcc822ec875eed248ca62a587ca146ada754a85decf4ac833b76a6c2a909719d5479b5ab721bcd14a599ebdfdef7f456d8007f5eb8d9b6e1b57584dd227
-
SSDEEP
6144:g68gSfhk7ElpHrVbUWGDctV7GhmER2a+RspHaLp5j1mcY3mEDm8I0:g68gOhYyHrVdGU1GhmhRsuRY3fw0
Static task
static1
Behavioral task
behavioral1
Sample
5d568a9de60d5265370f58305f1d942d_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
qakbot
324.8
spx55
1579706138
104.191.66.184:443
173.79.220.156:443
83.76.204.98:2222
24.189.222.222:2222
65.33.58.73:443
74.194.4.181:443
72.90.243.117:443
97.96.51.117:443
186.47.208.238:50000
98.121.187.78:443
76.23.204.29:443
109.169.194.16:21
24.201.79.208:2078
72.218.167.183:443
69.123.179.70:443
68.14.210.246:22
67.250.76.135:443
205.250.79.62:443
72.255.200.129:2222
71.201.79.21:2222
174.20.97.194:995
80.14.209.42:2222
67.223.197.134:443
2.50.75.77:995
69.92.54.95:995
99.231.221.117:443
67.60.113.253:2222
99.228.197.117:995
24.184.6.58:2222
50.78.93.74:995
172.78.87.180:443
99.228.5.106:443
78.13.212.163:2222
72.224.159.224:2222
174.82.131.155:995
107.12.131.249:443
108.227.161.27:443
73.226.220.56:443
72.142.106.198:995
208.93.202.49:443
70.161.87.179:443
75.81.25.223:995
189.155.180.214:443
23.240.185.215:443
206.183.190.53:995
47.203.89.36:443
74.105.139.160:443
24.202.42.48:2222
74.102.76.221:443
72.187.35.131:443
70.164.39.91:443
66.222.88.126:995
68.59.27.48:443
189.140.49.182:443
47.40.209.205:443
187.205.216.200:443
174.48.72.160:443
71.197.126.250:443
70.177.25.99:443
71.77.231.251:443
65.30.12.240:443
47.146.169.85:443
72.29.181.77:2078
152.208.21.141:995
181.123.59.111:443
98.252.150.180:443
5.182.39.156:443
74.33.70.89:443
96.234.20.230:443
74.96.151.6:443
71.80.227.238:443
71.182.142.63:443
73.137.187.150:443
104.152.16.45:995
73.238.105.117:443
72.142.106.198:993
75.90.230.120:995
66.25.168.167:2222
189.163.230.27:2222
68.1.115.106:443
35.134.202.234:443
65.185.84.240:443
71.88.220.181:443
76.179.51.148:443
74.129.26.223:443
137.119.216.25:443
206.255.1.65:443
63.230.16.166:2083
47.153.115.154:995
67.246.16.250:995
201.152.138.190:995
72.142.106.198:465
24.176.89.211:443
172.242.80.243:443
24.229.150.54:995
69.133.112.13:443
96.242.232.231:443
74.135.85.117:443
69.10.105.206:443
2.50.170.218:443
100.38.164.182:443
75.70.218.193:443
108.51.247.203:443
104.173.119.54:2222
75.182.214.87:443
2.187.95.113:995
111.125.70.30:2222
67.10.18.112:993
73.195.20.237:443
173.3.132.17:995
70.124.29.226:443
73.57.178.191:443
206.51.202.106:50002
24.164.79.147:443
47.40.244.237:443
72.190.101.70:443
181.126.80.118:443
187.163.101.137:995
74.78.77.189:443
72.209.191.27:443
188.61.134.98:2222
64.19.74.29:995
79.163.146.126:2222
73.230.161.72:443
73.133.46.105:995
173.61.231.209:443
71.226.140.73:443
108.50.156.219:443
75.130.117.134:443
75.88.91.188:443
108.55.23.221:443
68.238.56.27:443
72.16.212.107:465
173.31.178.20:443
70.62.160.186:6883
96.35.170.82:2222
50.247.230.33:995
81.132.208.133:2222
179.36.40.220:443
70.176.164.129:443
108.190.148.31:2222
181.197.195.138:995
162.244.225.30:443
71.30.56.170:443
5.78.240.1:995
66.208.105.6:443
68.192.80.248:443
24.27.82.216:2222
137.99.224.198:443
68.49.120.179:443
Targets
-
-
Target
5d568a9de60d5265370f58305f1d942d_JaffaCakes118
-
Size
400KB
-
MD5
5d568a9de60d5265370f58305f1d942d
-
SHA1
b249a7bbda785a1194c6a40699439a639a806521
-
SHA256
767bfbc1a25997de2d6203b7ec79afe012f1049eda612efb5c51e4da68972b58
-
SHA512
0e80dbcc822ec875eed248ca62a587ca146ada754a85decf4ac833b76a6c2a909719d5479b5ab721bcd14a599ebdfdef7f456d8007f5eb8d9b6e1b57584dd227
-
SSDEEP
6144:g68gSfhk7ElpHrVbUWGDctV7GhmER2a+RspHaLp5j1mcY3mEDm8I0:g68gOhYyHrVdGU1GhmhRsuRY3fw0
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-