General
-
Target
51601db1429ed21df37e13595f747a24_JaffaCakes118
-
Size
680KB
-
Sample
240717-ejfwmsvdnq
-
MD5
51601db1429ed21df37e13595f747a24
-
SHA1
9e789cfb4f7cd4f9fef73788563db2e6346da7a7
-
SHA256
038627ce6353359c1dab0894a97d2fab109f403c72e014e0f6d90d45b0c78574
-
SHA512
ab463b626ce0534ac799f4cf3a1525bdb51394bd40473ea663d9d95e5f16451444f431c9b7839bca423947284d6a6cc3ee57e5ca188718c0fc943c73ce0d6e7d
-
SSDEEP
12288:g02SvuVAr2SbCQGEwpch13kzm17Wx5pRHUNH+3mg2DKbuJ6ZlRf/mMoS:72N8Jh+cP77s5/Up+3m1Z6ZlRW
Static task
static1
Behavioral task
behavioral1
Sample
51601db1429ed21df37e13595f747a24_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
51601db1429ed21df37e13595f747a24_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
cybergate
v1.07.5
Cyber
obaaa65.no-ip.info:100
P2OEL3MU56067V
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WinDir
-
install_file
Svchost.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
Spotify.ddll Could not be located. Reinstalling Spotify could solve this error.
-
message_box_title
Spotify
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
51601db1429ed21df37e13595f747a24_JaffaCakes118
-
Size
680KB
-
MD5
51601db1429ed21df37e13595f747a24
-
SHA1
9e789cfb4f7cd4f9fef73788563db2e6346da7a7
-
SHA256
038627ce6353359c1dab0894a97d2fab109f403c72e014e0f6d90d45b0c78574
-
SHA512
ab463b626ce0534ac799f4cf3a1525bdb51394bd40473ea663d9d95e5f16451444f431c9b7839bca423947284d6a6cc3ee57e5ca188718c0fc943c73ce0d6e7d
-
SSDEEP
12288:g02SvuVAr2SbCQGEwpch13kzm17Wx5pRHUNH+3mg2DKbuJ6ZlRf/mMoS:72N8Jh+cP77s5/Up+3m1Z6ZlRW
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-