General
-
Target
5a8656da70b6347f75b94da217d22c4f_JaffaCakes118
-
Size
63KB
-
Sample
240719-fffxxawgqg
-
MD5
5a8656da70b6347f75b94da217d22c4f
-
SHA1
0876e2ef23c36cc4e9259574a2376a42d6a1cd9a
-
SHA256
562eb37dd29aee57281433d094572f0a0c8fe9e45af537017d25a42b89c8ac46
-
SHA512
b3a587332bddc4f6396d8dc9510d9a55d48e4b35a20716a838383efcdd1405b603c4191bffd6d2c7d219590385bc6ac37e3003243efb4285b39215b925d62c1b
-
SSDEEP
1536:xtFFQ7Rw9l1hnyI9St5v57J2HCMxGGA1FVr9jV9CqE:xtDERanMvFAHHhAFfDy
Static task
static1
Behavioral task
behavioral1
Sample
5a8656da70b6347f75b94da217d22c4f_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
limerat
-
aes_key
dame
-
antivm
false
-
c2_url
https://pastebin.com/raw/dPL0gsvg
-
delay
3
-
download_payload
false
-
install
true
-
install_name
israel.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/dPL0gsvg
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Targets
-
-
Target
5a8656da70b6347f75b94da217d22c4f_JaffaCakes118
-
Size
63KB
-
MD5
5a8656da70b6347f75b94da217d22c4f
-
SHA1
0876e2ef23c36cc4e9259574a2376a42d6a1cd9a
-
SHA256
562eb37dd29aee57281433d094572f0a0c8fe9e45af537017d25a42b89c8ac46
-
SHA512
b3a587332bddc4f6396d8dc9510d9a55d48e4b35a20716a838383efcdd1405b603c4191bffd6d2c7d219590385bc6ac37e3003243efb4285b39215b925d62c1b
-
SSDEEP
1536:xtFFQ7Rw9l1hnyI9St5v57J2HCMxGGA1FVr9jV9CqE:xtDERanMvFAHHhAFfDy
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-