General
-
Target
89beb0ac0f3f7baab70c9893e48b8f0c_JaffaCakes118
-
Size
202KB
-
Sample
240601-h92sksef97
-
MD5
89beb0ac0f3f7baab70c9893e48b8f0c
-
SHA1
8a1abff033f6fec30379d36986ea8a522439a40a
-
SHA256
f2e9f344eade3e5f696600ca5652a4265b44f5469aca97ef168d4e28b3d09027
-
SHA512
9dd1113ee9e110b5d74b6a39f924203cc684958cf1c8017cf77751521ecc5d72006ecfb97b97bf24af44ffb2b19a26048f9eccb5ec4f63cd8bcdfad14229f3cb
-
SSDEEP
3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15R:PjdFKdoSxvixTxUA
Behavioral task
behavioral1
Sample
89beb0ac0f3f7baab70c9893e48b8f0c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
89beb0ac0f3f7baab70c9893e48b8f0c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Malware Config
Extracted
cobaltstrike
0
http://138.197.2.46:2333/pixel
-
access_type
512
-
create_remote_thread
768
-
crypto_scheme
256
-
host
138.197.2.46,/pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
60000
-
port_number
2333
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZPDczQ6BGXg1jewgwDfwlr2kG6PrQ7umfvODRLZT1FH1KmB6KDo3LkEe9wqxa7T0ymXS7LI6bpWxMmp5pJ+j/BEkQFzeVtzpbEC1g0loEUdjH2+t4f1AshdkHCUwS9gW0pXk3ftQKGOsQsEGOTHK0uHT6U+6R8DE28u/NckANxQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSSEM)
-
watermark
0
Targets
-
-
Target
89beb0ac0f3f7baab70c9893e48b8f0c_JaffaCakes118
-
Size
202KB
-
MD5
89beb0ac0f3f7baab70c9893e48b8f0c
-
SHA1
8a1abff033f6fec30379d36986ea8a522439a40a
-
SHA256
f2e9f344eade3e5f696600ca5652a4265b44f5469aca97ef168d4e28b3d09027
-
SHA512
9dd1113ee9e110b5d74b6a39f924203cc684958cf1c8017cf77751521ecc5d72006ecfb97b97bf24af44ffb2b19a26048f9eccb5ec4f63cd8bcdfad14229f3cb
-
SSDEEP
3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15R:PjdFKdoSxvixTxUA
Score3/10 -