General
-
Target
6549eac35a9427c1b5d294da088e6730_JaffaCakes118
-
Size
202KB
-
Sample
240522-adj9naed28
-
MD5
6549eac35a9427c1b5d294da088e6730
-
SHA1
b0dc18d67b60b3190f9548d192d2295e925c69e8
-
SHA256
00b1026ac1c50f331e97f045ff1e19ea4d289073ce1cc53b09302d02784e4426
-
SHA512
32cf462761d5813b8983507ed34af31e78b0c45d6bd1c536722233cd71e130f99b0705fb1216f7a4d6071b9fec510021adce675c3137c17addb1fdd0cdfa49d4
-
SSDEEP
3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15j:PjdFKdoSxvixTxUA
Behavioral task
behavioral1
Sample
6549eac35a9427c1b5d294da088e6730_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6549eac35a9427c1b5d294da088e6730_JaffaCakes118.dll
Resource
win10v2004-20240426-en
Malware Config
Extracted
cobaltstrike
0
http://39.109.5.64:443/ptj
-
access_type
512
-
create_remote_thread
768
-
crypto_scheme
256
-
host
39.109.5.64,/ptj
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEs862SQtKdXfNnUT6fTKG0qo28B0MnsXZhbAL/3Ce3dksZKv0LKWo0MO0S4csnvyxw68f9i4IjxFQan1pzq8hyT9mshbzGy/8K+znpJal5nc8p9ESrnUivQh5Pz/llOD4kZi602juNy77nfrx+y0qWZLand28ru2+n1Q654O73QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Targets
-
-
Target
6549eac35a9427c1b5d294da088e6730_JaffaCakes118
-
Size
202KB
-
MD5
6549eac35a9427c1b5d294da088e6730
-
SHA1
b0dc18d67b60b3190f9548d192d2295e925c69e8
-
SHA256
00b1026ac1c50f331e97f045ff1e19ea4d289073ce1cc53b09302d02784e4426
-
SHA512
32cf462761d5813b8983507ed34af31e78b0c45d6bd1c536722233cd71e130f99b0705fb1216f7a4d6071b9fec510021adce675c3137c17addb1fdd0cdfa49d4
-
SSDEEP
3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15j:PjdFKdoSxvixTxUA
Score3/10 -