General
-
Target
679dab69dfd8d8a29438b42643b91e22_JaffaCakes118
-
Size
1.7MB
-
Sample
240723-pr319azdmm
-
MD5
679dab69dfd8d8a29438b42643b91e22
-
SHA1
1d82a1353b37db0cdeef67b8a3a833f707995ac5
-
SHA256
5137ed4add504869782db4bf3c9c5539010c50f4fa7bee478610df46fe9fd34f
-
SHA512
dbbdbd0114b1e52bafcf3b9f1d13781815099bdb23c3501c6652f9e9650f56f6d857189d401cc96544fb56e3ad7776be15cb1adeaf8a9d503d3d6837f017d1c0
-
SSDEEP
24576:h7FQg02OkDa9NPZZwrHcgIzQoT3yNK1AD0ITELmHm:RyzX1H8
Static task
static1
Behavioral task
behavioral1
Sample
679dab69dfd8d8a29438b42643b91e22_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
679dab69dfd8d8a29438b42643b91e22_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
darkcomet
victim
aslan6.zapto.org:1604
DC_MUTEX-Q50A43E
-
InstallPath
system32\winlogen.exe
-
gencode
3z7ihZbVu7mE
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
winlogen
Targets
-
-
Target
679dab69dfd8d8a29438b42643b91e22_JaffaCakes118
-
Size
1.7MB
-
MD5
679dab69dfd8d8a29438b42643b91e22
-
SHA1
1d82a1353b37db0cdeef67b8a3a833f707995ac5
-
SHA256
5137ed4add504869782db4bf3c9c5539010c50f4fa7bee478610df46fe9fd34f
-
SHA512
dbbdbd0114b1e52bafcf3b9f1d13781815099bdb23c3501c6652f9e9650f56f6d857189d401cc96544fb56e3ad7776be15cb1adeaf8a9d503d3d6837f017d1c0
-
SSDEEP
24576:h7FQg02OkDa9NPZZwrHcgIzQoT3yNK1AD0ITELmHm:RyzX1H8
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-