General
-
Target
67362eac69e68f87761ed29cf6c0de61_JaffaCakes118
-
Size
331KB
-
Sample
240723-mjr8nssamm
-
MD5
67362eac69e68f87761ed29cf6c0de61
-
SHA1
b5f43de3c76c14aa5324e63f95d1bf3d0f28d4c1
-
SHA256
7f28f98e7366324e07cf9192b6de4bfd6a37bb0c49ac8290900bd45e270ae4a4
-
SHA512
c0f0b4e1207fd9d45c7e07b1e85d0d670fd8d20bcc3fe0347140f76941bbd445959e2ebe54bd89e8ac120bf08c971cd8f415385c00d8dd4ee789ed9eff941d79
-
SSDEEP
6144:v0PR1GeF16LcO3iKhv8zJbHhS3ZEUpbbVHY:8PvGeqoZE7XV
Static task
static1
Behavioral task
behavioral1
Sample
67362eac69e68f87761ed29cf6c0de61_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
darkcomet
Guest16
Swagest.zapto.org:1604
DC_MUTEX-PLGFKC5
-
gencode
LCN5BwVguN9A
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
67362eac69e68f87761ed29cf6c0de61_JaffaCakes118
-
Size
331KB
-
MD5
67362eac69e68f87761ed29cf6c0de61
-
SHA1
b5f43de3c76c14aa5324e63f95d1bf3d0f28d4c1
-
SHA256
7f28f98e7366324e07cf9192b6de4bfd6a37bb0c49ac8290900bd45e270ae4a4
-
SHA512
c0f0b4e1207fd9d45c7e07b1e85d0d670fd8d20bcc3fe0347140f76941bbd445959e2ebe54bd89e8ac120bf08c971cd8f415385c00d8dd4ee789ed9eff941d79
-
SSDEEP
6144:v0PR1GeF16LcO3iKhv8zJbHhS3ZEUpbbVHY:8PvGeqoZE7XV
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-