General
-
Target
bc0872c6ade198032b1d8547d1366ab7_JaffaCakes118
-
Size
279KB
-
Sample
240618-p4av8sycnm
-
MD5
bc0872c6ade198032b1d8547d1366ab7
-
SHA1
a2511644d4d18349b53913c018f8aa444a65b59c
-
SHA256
36f15aee254275fbabb7fa07f09bc17c17b91624f22844f687f816b689a66c22
-
SHA512
2b63f98729f1333468bf697913494924177c735b50ee24e4561b85b6fef1cbed5a08d49fdd99f6101c5689dbc23cab8a91fe7ad5bd4fc242c2433e2e1997a70a
-
SSDEEP
6144:SJLxeIHdu+1jZjK/ReQVD3M0pisQf8zoB6gGTUFkYe5P1JIxlSPKQQJ:3IcekemSg86rck35NalX
Static task
static1
Behavioral task
behavioral1
Sample
Urgent Arabian American Oil Company Tender..exe
Resource
win7-20240611-en
Malware Config
Extracted
nanocore
1.2.2.0
rolex.ddns.net:4354
91.192.100.3:4354
40eac189-eeb0-451f-9b5a-4de11b5cec85
-
activate_away_mode
true
-
backup_connection_host
91.192.100.3
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-04-08T09:03:22.291940136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4354
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
40eac189-eeb0-451f-9b5a-4de11b5cec85
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
rolex.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
Urgent Arabian American Oil Company Tender..exe
-
Size
496KB
-
MD5
67d4023a5aaab69d59959d0728bed56c
-
SHA1
77cfae73cefa142e3ed5d960bef5247d04806bd1
-
SHA256
e6be68301afc61e68d370df534c24a654c4639654113a346bb5cea2a7195d0ce
-
SHA512
162df92e15d7bcad66e296e4b6e79fe72c4926257e087651ba85e1b0053d589f58b52a0ab7e60f5e7b234d878bb68ae027c6c697148c8c433a12f9117ff2a86e
-
SSDEEP
6144:OYJFyyAdPXFFkHLWIZX5SoIYuJoy/ReQxD3M0pisQf83zvzkbszOCCFU1WCcDcC1:OgtAhXFFkHTh5/ce4SWo4xSzZ
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-