General
-
Target
3cfe3c67fcddd89a702d21284ba3d165_JaffaCakes118
-
Size
556KB
-
Sample
240712-mfh6la1gkb
-
MD5
3cfe3c67fcddd89a702d21284ba3d165
-
SHA1
73693f562520d7d6dc239a82de4c01f06183c674
-
SHA256
4921525fdbec4c32c91dcbda29c6abafa6abb1965c89907aa1c3ffc5dcc35c61
-
SHA512
0cfebcabd55af45a6aec352793b0ef1843968d677287ccaff3a76faab6e1a904419ee277f8c4fdeb5fa21e26ac211d2f1760790ad6cec22395769d57971d60bb
-
SSDEEP
12288:rSaGIQGWQqjV2ORiP2bstHTE0aeZmC1bDsT9dkFADKOG9elzdKWFYG+:rxQCqjtRiP2bsto0aSJspOFA1GgzsYR+
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.19022021.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
NEW ORDER.19022021.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1599185091:AAFwjZ99E4P1IuAWSo1Ue568J97WLOPoV88/sendMessage?chat_id=652007142
Targets
-
-
Target
NEW ORDER.19022021.exe
-
Size
680KB
-
MD5
b66330a8ce88bf8289252f2d1fba8c36
-
SHA1
f6f6fbd9abb724a9b669415f03e0ee10516e736d
-
SHA256
8cfafa2cbc8c24afe00f82ca7beef18000cd3ad1a2f45c97a0a6e1921df0c92f
-
SHA512
565e47f13578cf3f96d65294e2613b9d0d888faf50bdb37ff89b44f24b3b4630c3325bc2e36a2eab2fcadf1301ae59b7112977fc9605e05deafac0ae7b7c09b5
-
SSDEEP
12288:BEz6hGceTorDIW87RfD4dGGsX/evWmZi0elxw1I9xI/RYhl7wFzo/j:fBr0W8mdGoOmclN9+ml+o/
Score10/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-