General
-
Target
1b3c5144369e21c102063fc18adae793_JaffaCakes118
-
Size
1.1MB
-
Sample
240701-n9ldgstfqq
-
MD5
1b3c5144369e21c102063fc18adae793
-
SHA1
1390f21e61d7c52d967f5895ebf6e67ef4dbcff9
-
SHA256
b0deda9f8354364d78134de41f845a194f29dc6e24f6e68c6d959e2e518f3791
-
SHA512
ac76a7ccfaaf69fbfac7d4b564abeb19c9f3610488d085ef01309609f15ed643476c4b9193c7f095c935290d1293af0debae80cca98fbff576a2fc81ef1dcd7c
-
SSDEEP
24576:4a/ei0ZhOFpzx3UBgD3hqe/OqzsnvG3+XrJLHMZ2qWItqPTz:Yi0sFN1zMuCJLHn
Static task
static1
Behavioral task
behavioral1
Sample
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
nanocore
1.2.2.0
queda2122.ddns.net:110
queda212.ddns.net:110
a59769ae-d88b-48a6-9aeb-eba13186dd16
-
activate_away_mode
true
-
backup_connection_host
queda212.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-05-01T17:12:48.076145036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
110
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
a59769ae-d88b-48a6-9aeb-eba13186dd16
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
queda2122.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
1b3c5144369e21c102063fc18adae793_JaffaCakes118
-
Size
1.1MB
-
MD5
1b3c5144369e21c102063fc18adae793
-
SHA1
1390f21e61d7c52d967f5895ebf6e67ef4dbcff9
-
SHA256
b0deda9f8354364d78134de41f845a194f29dc6e24f6e68c6d959e2e518f3791
-
SHA512
ac76a7ccfaaf69fbfac7d4b564abeb19c9f3610488d085ef01309609f15ed643476c4b9193c7f095c935290d1293af0debae80cca98fbff576a2fc81ef1dcd7c
-
SSDEEP
24576:4a/ei0ZhOFpzx3UBgD3hqe/OqzsnvG3+XrJLHMZ2qWItqPTz:Yi0sFN1zMuCJLHn
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-