General
-
Target
3447b89187133d1975648f4087b3300e_JaffaCakes118
-
Size
171KB
-
Sample
240710-l49ssa1fkn
-
MD5
3447b89187133d1975648f4087b3300e
-
SHA1
22598110c0b09905f69a22fce50ff2441acadf83
-
SHA256
7506af8f220c1237b0c57375820f382bc3cba14c5a313ae568b066e91ddd2c9b
-
SHA512
8b5cfd8601cea011c6b09013e12c692500cfc768a24a3ffb0998fa3713f5a40e218ac5a0930eabf3eccabd470222f22e170c5e94c7f08eb00a6f7af842fa5ace
-
SSDEEP
1536:X9wTi1AJmKESNJJHTvZegHLC/Vy5P7nRK8MG68Liik4TFjhMc2T7OsrUqt+cf8y3:NaNmy7njLiaxec2HdrUqt+cf1iesW1
Static task
static1
Behavioral task
behavioral1
Sample
3447b89187133d1975648f4087b3300e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3447b89187133d1975648f4087b3300e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
tofsee
64.20.54.234
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Targets
-
-
Target
3447b89187133d1975648f4087b3300e_JaffaCakes118
-
Size
171KB
-
MD5
3447b89187133d1975648f4087b3300e
-
SHA1
22598110c0b09905f69a22fce50ff2441acadf83
-
SHA256
7506af8f220c1237b0c57375820f382bc3cba14c5a313ae568b066e91ddd2c9b
-
SHA512
8b5cfd8601cea011c6b09013e12c692500cfc768a24a3ffb0998fa3713f5a40e218ac5a0930eabf3eccabd470222f22e170c5e94c7f08eb00a6f7af842fa5ace
-
SSDEEP
1536:X9wTi1AJmKESNJJHTvZegHLC/Vy5P7nRK8MG68Liik4TFjhMc2T7OsrUqt+cf8y3:NaNmy7njLiaxec2HdrUqt+cf1iesW1
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-