General
-
Target
95a7077a78388d8c910e65177a20c1cd_JaffaCakes118
-
Size
5.9MB
-
Sample
240604-vt7p4sec88
-
MD5
95a7077a78388d8c910e65177a20c1cd
-
SHA1
eeb04eb1c9a3537e375f38098e7b8767d277f568
-
SHA256
4516b0dc74e1be9fe2a06d26bd92018a572fd63006604730733e5be2f3547f90
-
SHA512
ec1e1fc2a4cbe49f1575621b16d2ac8c1bea22bbf53cca283dd9ded964bfa86d3fc6246a08e0f60a2be4ea582dee2651f3ecd70a4254ba64b5ab5fbf8d3f9777
-
SSDEEP
6144:sPIpEvUeazs9JSMeyUPFlsy4SEUY3V2kz5t8FF9SSl9sc8UNh5:UIpqdaNMeyUPFlR4SEU+VpdIT8U35
Static task
static1
Behavioral task
behavioral1
Sample
95a7077a78388d8c910e65177a20c1cd_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
qakbot
325.14
tr01
1596554163
94.59.241.189:2222
86.98.66.175:2222
94.96.84.73:993
71.83.16.211:443
24.110.96.149:443
78.96.199.79:443
216.201.162.158:443
68.60.221.169:465
95.76.109.181:443
189.231.175.46:443
70.164.37.205:995
108.27.217.44:443
71.220.191.200:443
92.59.35.196:2222
71.192.44.92:443
108.30.125.94:443
93.151.180.170:61202
189.130.26.216:443
47.146.32.175:443
24.71.28.247:443
12.5.37.3:995
79.113.219.10:443
70.126.76.75:443
78.100.192.173:443
199.247.22.145:443
5.193.178.241:2078
144.202.48.107:443
90.175.88.99:2222
81.133.234.36:2222
151.73.120.201:443
166.62.180.194:2078
201.216.216.245:443
103.238.231.40:443
187.205.235.21:443
189.210.114.157:443
68.116.193.239:443
84.117.176.32:443
151.52.157.19:443
188.26.243.186:443
108.45.89.47:443
179.14.167.91:443
189.223.67.126:443
94.96.84.73:21
75.170.94.218:443
174.80.7.235:443
68.134.181.98:443
86.120.237.47:2222
51.9.198.243:2222
94.96.84.73:20
172.87.134.226:443
189.150.106.26:995
188.15.173.34:995
24.204.155.208:443
63.155.9.141:995
96.20.108.17:2222
187.192.233.135:995
115.21.224.117:443
98.4.227.199:443
5.15.54.233:443
217.165.112.13:995
207.255.161.8:993
86.126.206.141:443
188.25.192.41:443
78.97.207.104:443
189.140.64.53:443
209.182.122.217:443
173.173.72.199:443
35.134.202.234:443
134.0.196.46:995
75.136.40.155:443
70.95.118.217:443
67.6.62.74:443
186.28.178.94:443
98.173.34.212:995
173.22.120.11:2222
108.46.145.30:443
108.35.135.148:443
94.96.84.73:443
86.97.9.224:443
67.11.43.93:443
154.56.71.174:443
24.99.180.247:443
65.48.219.163:443
69.47.26.41:443
188.27.27.107:443
67.247.254.82:443
172.78.82.95:443
72.204.242.138:6881
199.247.16.80:443
80.240.26.178:443
76.187.12.181:443
5.13.102.138:995
86.153.98.2:2222
208.93.202.49:443
96.35.170.82:2078
2.51.240.61:995
67.165.206.193:993
5.15.84.129:443
67.8.103.21:443
151.205.102.42:443
96.232.203.15:443
72.240.200.181:2222
70.123.92.175:2222
73.228.1.246:443
75.111.145.5:995
24.231.54.185:2222
98.115.243.237:443
96.234.20.230:443
96.255.188.58:443
174.82.131.155:995
90.68.84.121:2222
73.227.232.166:443
71.182.142.63:443
109.92.251.113:995
24.139.132.70:443
130.25.130.19:2222
35.143.248.234:443
190.204.24.148:2078
45.32.155.12:443
173.163.115.89:2078
207.246.75.201:443
35.209.218.146:443
45.32.154.10:443
217.162.149.212:443
72.142.106.198:995
75.137.47.174:443
83.110.92.29:443
36.226.77.179:443
5.107.157.123:2222
176.205.255.97:443
213.120.109.73:2222
41.97.200.95:443
2.88.50.153:995
173.44.112.112:443
200.38.254.177:443
24.229.150.54:995
71.10.43.79:443
72.82.15.220:443
99.231.221.117:443
47.44.217.98:443
186.6.197.11:443
217.165.164.57:2222
71.88.104.107:443
68.204.164.222:443
73.104.218.229:0
173.245.152.231:443
24.203.36.180:2222
86.98.89.132:2222
24.28.183.107:995
Targets
-
-
Target
95a7077a78388d8c910e65177a20c1cd_JaffaCakes118
-
Size
5.9MB
-
MD5
95a7077a78388d8c910e65177a20c1cd
-
SHA1
eeb04eb1c9a3537e375f38098e7b8767d277f568
-
SHA256
4516b0dc74e1be9fe2a06d26bd92018a572fd63006604730733e5be2f3547f90
-
SHA512
ec1e1fc2a4cbe49f1575621b16d2ac8c1bea22bbf53cca283dd9ded964bfa86d3fc6246a08e0f60a2be4ea582dee2651f3ecd70a4254ba64b5ab5fbf8d3f9777
-
SSDEEP
6144:sPIpEvUeazs9JSMeyUPFlsy4SEUY3V2kz5t8FF9SSl9sc8UNh5:UIpqdaNMeyUPFlR4SEU+VpdIT8U35
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-