General
-
Target
6257fd46a82fb55b54fb99a0811814d4_JaffaCakes118
-
Size
950KB
-
Sample
240722-jktlcawgqr
-
MD5
6257fd46a82fb55b54fb99a0811814d4
-
SHA1
11b17f1f90518375564aaf4d1dd5fce643266c18
-
SHA256
c97fe3f933837b651405d49b80f1604e1c5f277e8199fc49cca5553e0616d91e
-
SHA512
af875c98e7846f903682f3c58c3f4e19193af8f62f680e6bf08339b40e328b7a907d96d5ddfcba4cf308d9ac025a694969c7fdd27f4c6867a3853c7d6fa792cc
-
SSDEEP
24576:qYiXyLRepccu/014qQY3Ay2rC9o8lNPPq0:A8ghB80
Static task
static1
Behavioral task
behavioral1
Sample
6257fd46a82fb55b54fb99a0811814d4_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6257fd46a82fb55b54fb99a0811814d4_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
darkcomet
Nemja
polarx9000.no-ip.biz:1605
DC_MUTEX-Y2DYHKP
-
gencode
uJ5flS5dEnqQ
-
install
false
-
offline_keylogger
true
-
password
darkcomet
-
persistence
false
Targets
-
-
Target
6257fd46a82fb55b54fb99a0811814d4_JaffaCakes118
-
Size
950KB
-
MD5
6257fd46a82fb55b54fb99a0811814d4
-
SHA1
11b17f1f90518375564aaf4d1dd5fce643266c18
-
SHA256
c97fe3f933837b651405d49b80f1604e1c5f277e8199fc49cca5553e0616d91e
-
SHA512
af875c98e7846f903682f3c58c3f4e19193af8f62f680e6bf08339b40e328b7a907d96d5ddfcba4cf308d9ac025a694969c7fdd27f4c6867a3853c7d6fa792cc
-
SSDEEP
24576:qYiXyLRepccu/014qQY3Ay2rC9o8lNPPq0:A8ghB80
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-