General
-
Target
a3b3e085da443ae965b79f031ce4e16a_JaffaCakes118
-
Size
236KB
-
Sample
240613-d8zjlswgpr
-
MD5
a3b3e085da443ae965b79f031ce4e16a
-
SHA1
892bc9e3deeefb18cb03f3be1628ee12907fcde0
-
SHA256
8ea6ee5d93114668f667b73f9bfb979a5234830a8c6677efb2613b45b00682f1
-
SHA512
e6ec3c2722b8edc140c52410f345e1429b5f3559a77887351da779d45cf9c800ddd53461a3360eb99c7141b4bcab50844db4091e68de609e012c18e980940830
-
SSDEEP
6144:0kHXAYSQPlMXtTcMBVcBlR9pSVfU25M4GmKPH0OSIYXq:bXAYNPl4tDBVm9YCwHGmKHSI9
Static task
static1
Behavioral task
behavioral1
Sample
a3b3e085da443ae965b79f031ce4e16a_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a3b3e085da443ae965b79f031ce4e16a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
lokibot
http://kaokao-twn.com/exploitedreal/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
a3b3e085da443ae965b79f031ce4e16a_JaffaCakes118
-
Size
236KB
-
MD5
a3b3e085da443ae965b79f031ce4e16a
-
SHA1
892bc9e3deeefb18cb03f3be1628ee12907fcde0
-
SHA256
8ea6ee5d93114668f667b73f9bfb979a5234830a8c6677efb2613b45b00682f1
-
SHA512
e6ec3c2722b8edc140c52410f345e1429b5f3559a77887351da779d45cf9c800ddd53461a3360eb99c7141b4bcab50844db4091e68de609e012c18e980940830
-
SSDEEP
6144:0kHXAYSQPlMXtTcMBVcBlR9pSVfU25M4GmKPH0OSIYXq:bXAYNPl4tDBVm9YCwHGmKHSI9
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-