General
-
Target
90566a56f87cbb3de3ee406a8031a089_JaffaCakes118
-
Size
2.0MB
-
Sample
240603-dj43ssgh8y
-
MD5
90566a56f87cbb3de3ee406a8031a089
-
SHA1
5f37a415bc489f03e734b1447ee844e5b2df0822
-
SHA256
28854f11be752dcc0747681d6bc453b60bcb9cd9ce81c61280c434ea468cc1f9
-
SHA512
94794faab87f8e1ddf6b3867330d79010e2e06c61b3816e1984c8c047144f4d7ee4ed02d1c5f6f466a10f26498cd508f8413a1570058e47d94b326e15978ff79
-
SSDEEP
49152:4U/NHzhgPTQk56pfcwedikpmjLFPCgCniBYAsEZXbYdUV7sK5Fq:RH9gPTQk5dOZavFdOXbHi
Static task
static1
Behavioral task
behavioral1
Sample
90566a56f87cbb3de3ee406a8031a089_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
90566a56f87cbb3de3ee406a8031a089_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
90566a56f87cbb3de3ee406a8031a089_JaffaCakes118
-
Size
2.0MB
-
MD5
90566a56f87cbb3de3ee406a8031a089
-
SHA1
5f37a415bc489f03e734b1447ee844e5b2df0822
-
SHA256
28854f11be752dcc0747681d6bc453b60bcb9cd9ce81c61280c434ea468cc1f9
-
SHA512
94794faab87f8e1ddf6b3867330d79010e2e06c61b3816e1984c8c047144f4d7ee4ed02d1c5f6f466a10f26498cd508f8413a1570058e47d94b326e15978ff79
-
SSDEEP
49152:4U/NHzhgPTQk56pfcwedikpmjLFPCgCniBYAsEZXbYdUV7sK5Fq:RH9gPTQk5dOZavFdOXbHi
-
BitRAT payload
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-