General
-
Target
75db65df801529027b4884cb69ad85fa_JaffaCakes118
-
Size
104KB
-
Sample
240726-1ngjmawhkp
-
MD5
75db65df801529027b4884cb69ad85fa
-
SHA1
d4dbb10f5b8f9fd47647a7db5b90c1e8c2208a2c
-
SHA256
b10eea964752defb636667f3cd4641f1f8b5f3285ba583d4ed92868719c4d785
-
SHA512
8df56c19c65a4e8fdb75614f81f3735f18cf2b9d4ea38c388e5170f7cbc0b10b2e584a50e82319f4ceb9f3fdbf6eb9905feb1dc4527d16d9daf62ae8be33c06e
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Behavioral task
behavioral1
Sample
75db65df801529027b4884cb69ad85fa_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
75db65df801529027b4884cb69ad85fa_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
lokibot
http://becharnise.ir/fox/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
75db65df801529027b4884cb69ad85fa_JaffaCakes118
-
Size
104KB
-
MD5
75db65df801529027b4884cb69ad85fa
-
SHA1
d4dbb10f5b8f9fd47647a7db5b90c1e8c2208a2c
-
SHA256
b10eea964752defb636667f3cd4641f1f8b5f3285ba583d4ed92868719c4d785
-
SHA512
8df56c19c65a4e8fdb75614f81f3735f18cf2b9d4ea38c388e5170f7cbc0b10b2e584a50e82319f4ceb9f3fdbf6eb9905feb1dc4527d16d9daf62ae8be33c06e
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-