General
-
Target
662dbd4d149e7d078c0a4d67f2a9357e_JaffaCakes118
-
Size
422KB
-
Sample
240723-fblmlaydqn
-
MD5
662dbd4d149e7d078c0a4d67f2a9357e
-
SHA1
caaac6f8ae60789638b4bcf4bffcd2d56585d31d
-
SHA256
240ccdace41e9b2b4062da0824bcc114ca02dd8bd751e7f3801c5111b633d40b
-
SHA512
efcb98a3b7307c5bc86e81799cd43e9aa097eaac60cd4caef639a74896c720b479c8b0a76eae8770b241defaf18da3ae23453f93e005f7d970d40c495d196cd7
-
SSDEEP
6144:rVLyriePzOYM6Xlg/jeKNy1IabIR2ST9g/G27ogh/bxEu3fRBD1ctuD:xLyrieb71h1H52d6Hh/dEORBCtW
Static task
static1
Behavioral task
behavioral1
Sample
662dbd4d149e7d078c0a4d67f2a9357e_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
darkcomet
Guest16
brhoom1406.no-ip.org:1604
DC_MUTEX-Z9TA51H
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
WJD6oG3ucbGc
-
install
true
-
offline_keylogger
true
-
password
0566699323
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
662dbd4d149e7d078c0a4d67f2a9357e_JaffaCakes118
-
Size
422KB
-
MD5
662dbd4d149e7d078c0a4d67f2a9357e
-
SHA1
caaac6f8ae60789638b4bcf4bffcd2d56585d31d
-
SHA256
240ccdace41e9b2b4062da0824bcc114ca02dd8bd751e7f3801c5111b633d40b
-
SHA512
efcb98a3b7307c5bc86e81799cd43e9aa097eaac60cd4caef639a74896c720b479c8b0a76eae8770b241defaf18da3ae23453f93e005f7d970d40c495d196cd7
-
SSDEEP
6144:rVLyriePzOYM6Xlg/jeKNy1IabIR2ST9g/G27ogh/bxEu3fRBD1ctuD:xLyrieb71h1H52d6Hh/dEORBCtW
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-