General
-
Target
8895eec0d6f9c5bde4e5048824bdb693_JaffaCakes118
-
Size
687KB
-
Sample
240811-clafjazenj
-
MD5
8895eec0d6f9c5bde4e5048824bdb693
-
SHA1
916ac63e438fd1ffd6bde77fa7ee754a79d828ac
-
SHA256
a31bcf37accafafcde367f7519883a6a86b98b28fdd941aac3f78349fb0a66a8
-
SHA512
23c9812d76f3231c474b388f46b25a559e527faa4147769dc5d5fd85064b9e45f1b615e09748133d91f0d681bda8f3dd8209996e303a3a959bb1984963e18c6b
-
SSDEEP
12288:HcHZI1cGYYZ6QrsSeqVz4q03q1Wfmq4Omh7pnsVFaH3Y3/Y0iG:HV1cGYYZ6q1Oq033f54Oe9sXaHb0R
Static task
static1
Behavioral task
behavioral1
Sample
8895eec0d6f9c5bde4e5048824bdb693_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8895eec0d6f9c5bde4e5048824bdb693_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://95.174.65.246/pend/chan/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
8895eec0d6f9c5bde4e5048824bdb693_JaffaCakes118
-
Size
687KB
-
MD5
8895eec0d6f9c5bde4e5048824bdb693
-
SHA1
916ac63e438fd1ffd6bde77fa7ee754a79d828ac
-
SHA256
a31bcf37accafafcde367f7519883a6a86b98b28fdd941aac3f78349fb0a66a8
-
SHA512
23c9812d76f3231c474b388f46b25a559e527faa4147769dc5d5fd85064b9e45f1b615e09748133d91f0d681bda8f3dd8209996e303a3a959bb1984963e18c6b
-
SSDEEP
12288:HcHZI1cGYYZ6QrsSeqVz4q03q1Wfmq4Omh7pnsVFaH3Y3/Y0iG:HV1cGYYZ6q1Oq033f54Oe9sXaHb0R
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-