General
-
Target
2114fedf867e29b1f7eba497ba01d551_JaffaCakes118
-
Size
698KB
-
Sample
240728-yvvnqasaml
-
MD5
2114fedf867e29b1f7eba497ba01d551
-
SHA1
25ce7fff6945920f6eb77c66bd24927dff089bc2
-
SHA256
97153c7c5e189efdb956619d5adac5a619148accf4a07e425978861613c86499
-
SHA512
ac5c036c20b1118b6ccfb612e30358df0986ec420ece640f4203dc2cce2ae3a86fae07b9b332431159c56a08ba522ab2dd1d94d1e69ffe630282dc36516cbfd8
-
SSDEEP
12288:eLsRM001yPyu0pKgXNrUkS3aVDQGacd+61dCs+NEsudui3Q:eLsehDLNrk3Bcdv
Static task
static1
Behavioral task
behavioral1
Sample
2114fedf867e29b1f7eba497ba01d551_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2114fedf867e29b1f7eba497ba01d551_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
2114fedf867e29b1f7eba497ba01d551_JaffaCakes118
-
Size
698KB
-
MD5
2114fedf867e29b1f7eba497ba01d551
-
SHA1
25ce7fff6945920f6eb77c66bd24927dff089bc2
-
SHA256
97153c7c5e189efdb956619d5adac5a619148accf4a07e425978861613c86499
-
SHA512
ac5c036c20b1118b6ccfb612e30358df0986ec420ece640f4203dc2cce2ae3a86fae07b9b332431159c56a08ba522ab2dd1d94d1e69ffe630282dc36516cbfd8
-
SSDEEP
12288:eLsRM001yPyu0pKgXNrUkS3aVDQGacd+61dCs+NEsudui3Q:eLsehDLNrk3Bcdv
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-