General
-
Target
6585f5b87bab09b4b8ce8f92e4d25bfd_JaffaCakes118
-
Size
176KB
-
Sample
240522-bvwvfsga36
-
MD5
6585f5b87bab09b4b8ce8f92e4d25bfd
-
SHA1
04f6d5322a54a761ab43dfde2e07bf78e14d675d
-
SHA256
2436a90b83be5d1069225411f048d8cc6cad09506fb2a6c2dd480c07595c76e5
-
SHA512
c58dfbba11045ebe2bca9b16fc28d08792dd9be2420256007cde1c26744f801200ff1b8a988019bffca62ccb105da8410a69e1bfcf027d82cb92830aedf38772
-
SSDEEP
3072:of55pZgMio9BRVgfZIRQg7D2ABMQFuEPwQ2WEelMIx68hHDL:SD/9XCfZIS+MquWEen68NDL
Static task
static1
Behavioral task
behavioral1
Sample
6585f5b87bab09b4b8ce8f92e4d25bfd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6585f5b87bab09b4b8ce8f92e4d25bfd_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
mylobot
fywkuzp.ru:7432
zdrussle.ru:2173
pseyumd.ru:5492
stydodo.ru:2619
tqzknrx.com:1123
mdcqrxw.com:4984
tpwtgyw.com:9631
cnoyucn.com:9426
qhloury.com:4759
fnjxpwy.com:3863
csxpzlz.com:5778
wlkjopy.com:8778
mynfwwk.com:8427
uuitwxg.com:6656
agnxomu.com:8881
wcagsib.com:3547
fmniltb.com:9582
oapwxiu.com:3922
petrrry.com:7531
poubauo.com:4623
jlrylzw.com:4762
tjdqist.com:1155
ypynjxr.com:5388
uhelntm.com:4788
goaawik.com:8811
ncnijgb.com:7766
ugxbwjl.com:3739
paeitqb.com:1416
jxikhzp.com:3466
orfiiff.com:9941
mqwbebx.com:7563
dbggepx.com:9186
yscdptr.com:4597
qawggwk.com:4335
dbwrtps.com:9152
plziafl.com:8468
blgujzi.com:1473
xdtssuy.com:4499
hjzosou.com:6632
umxjept.com:5448
jsqahgh.com:6421
jtumdod.com:6425
knzuwpl.com:6262
dgpwxgw.com:6584
xruogma.com:1695
qnxhcqf.com:3236
rddlqgj.com:6812
wbcjlxn.com:2812
uqqgirw.com:2198
mkeamjf.com:3736
nwsztox.com:1788
ifmpdod.com:7381
uyuhthp.com:9686
yiaqewn.com:1265
upfijra.com:6772
jqizuas.com:3383
oxduwil.com:9178
wurhfah.com:6637
bcpbamn.com:1681
zjljapl.com:6718
ujebxum.com:3676
zrjtczf.com:4277
zjutffq.com:6963
bdlfrtt.com:2114
khasffr.com:3692
giktmlk.com:5532
emwtlmf.com:8954
lwbojdn.com:4363
tnclqjb.com:4584
hwzzhlz.com:1537
cceognr.com:9689
guegyro.com:4677
qjhimza.com:5329
hyiqppb.com:9925
sslpysi.com:1589
eahqyrh.com:7835
muaejwt.com:9766
atfwuia.com:8168
ffdswwi.com:9414
zziqxcn.com:7838
apbjhiu.com:4975
muuiaxf.com:2673
hihrfxy.com:9592
tpgwhtf.com:4889
kiajrcx.com:1787
cldbnzm.com:2871
gsjxycs.com:8294
brmgkod.com:1586
ocalflg.com:3261
nctpkes.com:5114
izgbroj.com:8774
scaurrn.com:4196
ahblatp.com:4559
cwefsaz.com:1283
syrpjbu.com:1968
jqlwhsl.com:5243
iypgdps.com:7311
logibrj.com:9426
ulqssaq.com:7863
uzhqgqr.com:2751
akpsxcf.com:3349
notwljg.com:2364
wiiarsk.com:1293
lgdlgqy.com:3546
eeakuno.net:3624
hpqxfes.net:8345
jfpfpmd.net:7752
ynazxcq.net:6325
uofiuzk.net:9221
xbkanjb.net:4862
jsojybj.net:6579
wpjbxsc.net:4859
pkhxopa.net:5719
ncrejzk.net:9193
giuwzmh.net:6815
zkaxxct.net:4237
xfceqzt.net:1322
hiixbda.net:3911
woicghe.net:9891
xxaautr.net:5642
fbteyne.net:8277
tsdcild.net:6444
ukznghq.net:3263
sjtkcrl.net:7242
qmheqsg.net:6522
Targets
-
-
Target
6585f5b87bab09b4b8ce8f92e4d25bfd_JaffaCakes118
-
Size
176KB
-
MD5
6585f5b87bab09b4b8ce8f92e4d25bfd
-
SHA1
04f6d5322a54a761ab43dfde2e07bf78e14d675d
-
SHA256
2436a90b83be5d1069225411f048d8cc6cad09506fb2a6c2dd480c07595c76e5
-
SHA512
c58dfbba11045ebe2bca9b16fc28d08792dd9be2420256007cde1c26744f801200ff1b8a988019bffca62ccb105da8410a69e1bfcf027d82cb92830aedf38772
-
SSDEEP
3072:of55pZgMio9BRVgfZIRQg7D2ABMQFuEPwQ2WEelMIx68hHDL:SD/9XCfZIS+MquWEen68NDL
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-