Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
25-05-2024 17:39
General
-
Target
72be6134413e147a8988d9b5046c9bff_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
72be6134413e147a8988d9b5046c9bff
-
SHA1
7d901b8eb959e16012f03034a15fa8fe5f036e78
-
SHA256
95be98d0ccd1cc708434918568b28f2db4e0abc6504b99967bdc4a77b60c9d1e
-
SHA512
4d593e8fda7ef1e0fe2d6c2f7aa21ede1666a61715c75ba2b9a6aa3358023b522a7750048b605e83a88c4e82ac32cbee8a979dd03cd04225f8e9268cd1312f1f
-
SSDEEP
49152:BXyBc+dXzhu8+0yDG3b1iVMmxP470NRFsNH:cBPdk8+0vr1iPF
Score
10/10
Malware Config
Extracted
Family
sendsafe
Botnet
UNREGISTERED
C2
91.220.131.40:50011
91.220.131.40:50012
Attributes
-
service_name
Enterprise Mailing Service
Signatures
-
SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
-
SendSafe payload 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\72be6134413e147a8988d9b5046c9bff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72be6134413e147a8988d9b5046c9bff_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
2.4MB