General
-
Target
283aeb8dfa6c77eea35b2b9bac39f670_JaffaCakes118
-
Size
1.3MB
-
Sample
240706-mkhqmawdnj
-
MD5
283aeb8dfa6c77eea35b2b9bac39f670
-
SHA1
97874c5720875e87e72fe2814fa71c3ebc685c1b
-
SHA256
86074b8645dfee9075aff87ce515385b90b12cb01d61704d66b006ea677438c0
-
SHA512
3d1e110a0927d38ffdca0591693feab169979fddd3276e04bd3da7eda8b3d7770221345684941acd5f70831d28bfb8324e94b06be35f9d1db5c454012f4866e8
-
SSDEEP
24576:Igh05KKSKOyddoHtK6nvTyfwOsAF/ANmzV3lw69m+XpLaPGAzMJD2r:BqkttvTFO/AYm+Zy/MJI
Static task
static1
Behavioral task
behavioral1
Sample
283aeb8dfa6c77eea35b2b9bac39f670_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
283aeb8dfa6c77eea35b2b9bac39f670_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
283aeb8dfa6c77eea35b2b9bac39f670_JaffaCakes118
-
Size
1.3MB
-
MD5
283aeb8dfa6c77eea35b2b9bac39f670
-
SHA1
97874c5720875e87e72fe2814fa71c3ebc685c1b
-
SHA256
86074b8645dfee9075aff87ce515385b90b12cb01d61704d66b006ea677438c0
-
SHA512
3d1e110a0927d38ffdca0591693feab169979fddd3276e04bd3da7eda8b3d7770221345684941acd5f70831d28bfb8324e94b06be35f9d1db5c454012f4866e8
-
SSDEEP
24576:Igh05KKSKOyddoHtK6nvTyfwOsAF/ANmzV3lw69m+XpLaPGAzMJD2r:BqkttvTFO/AYm+Zy/MJI
Score10/10-
StormKitty payload
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-