General
-
Target
83692b963ac09374938c6812eed4a814_JaffaCakes118
-
Size
636KB
-
Sample
240530-h4wdlsbe52
-
MD5
83692b963ac09374938c6812eed4a814
-
SHA1
4893bd7d55e17fa5db38af56b5c396bb4e02d9ec
-
SHA256
e175c9a8deaab55c34a819794d9a751021079caa9fb34faf232c686cf5fdd3c6
-
SHA512
894985b071be55eed4332d807da0eec413d4055b7260165d5c0a8282b2e8194b5436aee97492fa265609950ac27f9ccf7c4a9b225a9c4371acdea4a51031087d
-
SSDEEP
12288:tEIe3NA3HiCcLSMJ6C29Ghjp27JKHkM7ioQkDl223eAFQd86:tED3KSsPGlsoESp9Rs
Static task
static1
Behavioral task
behavioral1
Sample
83692b963ac09374938c6812eed4a814_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
83692b963ac09374938c6812eed4a814_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
lokibot
http://195.69.140.147/.op/cr.php/oyBLhG5AtUCNy
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
83692b963ac09374938c6812eed4a814_JaffaCakes118
-
Size
636KB
-
MD5
83692b963ac09374938c6812eed4a814
-
SHA1
4893bd7d55e17fa5db38af56b5c396bb4e02d9ec
-
SHA256
e175c9a8deaab55c34a819794d9a751021079caa9fb34faf232c686cf5fdd3c6
-
SHA512
894985b071be55eed4332d807da0eec413d4055b7260165d5c0a8282b2e8194b5436aee97492fa265609950ac27f9ccf7c4a9b225a9c4371acdea4a51031087d
-
SSDEEP
12288:tEIe3NA3HiCcLSMJ6C29Ghjp27JKHkM7ioQkDl223eAFQd86:tED3KSsPGlsoESp9Rs
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-