General
-
Target
67d4c892b84eedb150f12646f2b68ced_JaffaCakes118
-
Size
1.1MB
-
Sample
240723-q5nn6awejh
-
MD5
67d4c892b84eedb150f12646f2b68ced
-
SHA1
189d768900560d892bc845588be4fb85d862e83f
-
SHA256
92aa5a786e9e9e2accd6adf32041089031697ba260a663910bcb9b8c00a8503a
-
SHA512
7bd765b2cbde3043bbb427195ca7019aaeb0ec05475106536afde95f43a6ae97dbcfe321fb4f88d13919c4ec145ad43c6d78adab62166d3aedf41207685d8fe7
-
SSDEEP
24576:R1nXEVOwGUxptUuyyJRj+D4Xu22Lx2EB2xHE9bpAWDN6:R1nXEVOwGUxbtZxwOu2Un9FAWR6
Static task
static1
Behavioral task
behavioral1
Sample
67d4c892b84eedb150f12646f2b68ced_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
67d4c892b84eedb150f12646f2b68ced_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
darkcomet
280712
montre.no-ip.biz:28324
DC_MUTEX-1X1RURG
-
gencode
prXNaBS6eBvT
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
67d4c892b84eedb150f12646f2b68ced_JaffaCakes118
-
Size
1.1MB
-
MD5
67d4c892b84eedb150f12646f2b68ced
-
SHA1
189d768900560d892bc845588be4fb85d862e83f
-
SHA256
92aa5a786e9e9e2accd6adf32041089031697ba260a663910bcb9b8c00a8503a
-
SHA512
7bd765b2cbde3043bbb427195ca7019aaeb0ec05475106536afde95f43a6ae97dbcfe321fb4f88d13919c4ec145ad43c6d78adab62166d3aedf41207685d8fe7
-
SSDEEP
24576:R1nXEVOwGUxptUuyyJRj+D4Xu22Lx2EB2xHE9bpAWDN6:R1nXEVOwGUxbtZxwOu2Un9FAWR6
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-