General
-
Target
5ce4916abc949bf3c04bfb8184745397_JaffaCakes118
-
Size
4.3MB
-
Sample
240729-ytb5zsxgnq
-
MD5
5ce4916abc949bf3c04bfb8184745397
-
SHA1
a02521d9e351c3682b5eb5e4f541e0dcb5ef1960
-
SHA256
60f82b88809017646d1e61cfd919e0e33773f3035e78d78fe1a1b4e6540b4ff2
-
SHA512
6a2b13cdc9016889043fb7b8e9dfe0f6e6a18c5759c1e4893339cc95f4c9aaa970f76a1cd4dd17e9e121dec5f50056f2f6d4095e6f2e652e8fa7ea9118c95ffc
-
SSDEEP
24576:aIydQMFmTIaG+hzgK/sdZvaKBaJh+TxyQh:ednj5IzgK/sdZvaKBaJhgp
Static task
static1
Behavioral task
behavioral1
Sample
5ce4916abc949bf3c04bfb8184745397_JaffaCakes118.exe
Resource
win7-20240729-en
Malware Config
Extracted
qakbot
325.43
abc006
1600687594
72.204.242.138:20
75.136.40.155:443
207.255.161.8:443
80.240.26.178:443
86.122.241.39:2222
103.238.231.40:443
47.146.32.175:443
202.141.244.118:995
185.19.190.81:443
24.201.79.208:2078
178.87.21.21:443
66.222.88.126:995
185.246.9.69:995
172.78.30.215:443
83.110.6.64:2222
41.233.39.224:995
77.159.149.74:443
66.76.105.197:443
134.0.196.46:995
75.87.161.32:995
190.85.91.154:443
108.49.221.180:443
216.201.162.158:443
68.14.210.246:22
67.60.113.253:2222
5.81.250.6:2222
2.88.23.102:995
2.91.73.105:995
72.82.15.220:443
166.62.180.194:2078
95.77.144.238:443
118.160.50.197:443
188.26.11.29:2222
75.165.38.209:50002
188.247.252.243:443
41.228.222.129:443
151.73.116.80:443
86.97.184.46:2222
213.31.203.48:2222
108.185.113.12:443
216.163.4.136:443
24.27.82.216:2222
96.18.240.158:443
66.215.32.224:443
35.134.202.234:443
71.126.139.251:443
186.108.164.88:443
72.204.242.138:32102
207.255.161.8:465
80.14.209.42:2222
108.178.66.82:995
71.84.5.114:995
134.228.24.29:443
76.170.77.99:995
184.98.103.204:995
45.32.155.12:443
65.30.213.13:6882
71.187.170.235:443
103.76.160.110:443
67.165.206.193:993
207.255.161.8:2078
207.255.161.8:32100
186.147.222.63:443
68.174.15.223:443
98.22.65.76:443
68.174.9.179:443
67.209.195.198:443
72.204.242.138:465
69.11.247.242:443
75.81.25.223:443
47.44.217.98:443
93.86.219.77:995
86.97.11.96:443
50.232.172.114:443
184.180.157.203:2222
89.42.142.35:443
50.244.112.10:995
70.164.37.205:995
2.7.65.32:2222
207.255.161.8:993
69.167.206.238:50001
72.36.59.46:2222
46.208.130.88:2222
67.8.103.21:443
2.50.59.177:443
78.97.3.6:443
72.28.255.159:995
199.247.22.145:443
50.104.68.223:443
97.89.242.9:443
209.137.209.163:995
39.37.244.25:995
2.89.114.174:995
109.154.214.224:2222
81.133.234.36:2222
77.30.99.99:995
50.244.112.106:443
141.158.47.123:443
47.28.131.209:443
71.80.66.107:443
217.165.164.178:2222
24.37.178.158:443
207.255.161.8:995
31.5.21.66:443
71.182.142.63:443
72.204.242.138:990
77.27.174.49:995
144.139.47.206:443
65.131.74.186:995
189.231.196.236:443
45.32.154.10:443
45.77.193.83:443
94.52.68.72:443
207.246.75.201:443
108.5.34.248:443
67.170.137.8:443
117.218.208.239:443
195.162.106.93:2222
93.113.177.152:443
209.182.122.217:443
37.210.186.213:61201
191.84.14.222:443
59.98.96.237:443
64.121.114.87:443
72.66.47.70:443
196.221.9.166:443
207.237.1.152:443
2.51.247.10:995
199.116.241.147:443
95.179.247.224:443
96.30.198.161:443
199.247.16.80:443
203.106.195.67:443
71.221.92.98:443
24.234.86.201:995
96.41.93.96:443
103.206.112.234:443
176.223.82.244:995
207.255.161.8:2087
207.255.161.8:32103
98.121.187.78:443
72.204.242.138:53
36.77.151.211:443
47.146.169.85:443
74.75.216.202:443
173.22.125.129:2222
95.77.223.148:443
175.211.225.118:443
86.98.89.73:2222
80.195.103.146:2222
Targets
-
-
Target
5ce4916abc949bf3c04bfb8184745397_JaffaCakes118
-
Size
4.3MB
-
MD5
5ce4916abc949bf3c04bfb8184745397
-
SHA1
a02521d9e351c3682b5eb5e4f541e0dcb5ef1960
-
SHA256
60f82b88809017646d1e61cfd919e0e33773f3035e78d78fe1a1b4e6540b4ff2
-
SHA512
6a2b13cdc9016889043fb7b8e9dfe0f6e6a18c5759c1e4893339cc95f4c9aaa970f76a1cd4dd17e9e121dec5f50056f2f6d4095e6f2e652e8fa7ea9118c95ffc
-
SSDEEP
24576:aIydQMFmTIaG+hzgK/sdZvaKBaJh+TxyQh:ednj5IzgK/sdZvaKBaJhgp
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-