General
-
Target
8b3bfff65aa4aa9abbc366ce6d9cc239_JaffaCakes118
-
Size
1.2MB
-
Sample
240811-vpsqdstbja
-
MD5
8b3bfff65aa4aa9abbc366ce6d9cc239
-
SHA1
77e69b99e1823a5bc47fa8e395c272a7121f8680
-
SHA256
9adfaa5b63a6a5456740d383e463055f47b796114675f0912e185638ad135d4a
-
SHA512
ad845060c75ceee146cd1d3d4813774acd19a73b7139a297344ecd44116fefa4590109eae3376c1cbab97580b167e08754de91e951f143ac923258c868638464
-
SSDEEP
6144:qsHHUPFY76DEoS5rYU/LPlbuo2YILNkFVZ5VfUllOp2n2FxHot1WL+Lwb5tJRJ:cs6AoS5EU/Lp56kBgXOInmNouL+Lwb5r
Static task
static1
Behavioral task
behavioral1
Sample
8b3bfff65aa4aa9abbc366ce6d9cc239_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
qakbot
325.43
abc008
1600855273
77.30.99.99:995
122.165.181.76:995
72.28.255.159:995
108.46.145.30:443
45.77.193.83:443
207.246.75.201:443
108.5.34.248:443
203.198.96.200:443
188.52.107.171:995
184.96.141.112:993
74.129.24.163:443
24.218.181.15:443
197.57.51.59:443
217.162.149.212:443
24.27.82.216:2222
78.97.3.6:443
96.41.93.96:443
197.210.96.222:995
45.32.154.10:443
199.247.16.80:443
76.179.54.116:443
73.228.1.246:443
95.179.247.224:443
96.30.198.161:443
202.141.244.118:995
189.150.106.230:22
39.37.244.25:995
217.165.164.178:2222
51.223.53.162:443
95.77.144.238:443
93.149.253.201:2222
207.237.1.152:443
80.240.26.178:443
77.27.174.49:995
24.205.42.241:443
41.228.240.106:443
89.136.165.31:443
117.218.208.239:443
103.110.49.88:443
83.110.6.64:2222
209.182.122.217:443
75.165.38.209:50002
5.13.179.158:995
72.66.47.70:443
2.88.23.102:995
64.121.114.87:443
5.12.217.37:2222
86.98.89.73:2222
173.245.152.231:443
103.206.112.234:443
98.16.204.189:995
95.77.223.148:443
73.238.141.72:443
102.186.126.62:443
203.106.195.67:443
41.232.234.43:995
36.77.151.211:443
81.133.234.36:2222
151.73.116.80:443
46.53.38.139:443
41.97.86.137:443
45.32.155.12:443
68.46.142.48:995
172.112.163.197:2222
61.3.190.238:443
103.76.160.110:443
175.211.225.118:443
89.42.142.35:443
86.97.11.96:443
72.186.1.237:443
2.50.131.64:443
2.50.59.177:443
73.32.115.251:443
84.117.176.32:443
144.139.47.206:443
65.131.33.110:995
199.247.22.145:443
75.90.6.126:995
93.86.219.77:995
213.31.203.48:2222
2.89.114.174:995
109.154.214.224:2222
80.14.209.42:2222
185.246.9.69:995
94.52.160.116:443
173.21.10.71:2222
71.12.214.209:2222
74.73.27.35:443
95.76.31.12:443
188.26.182.94:443
47.138.201.136:443
81.103.144.77:443
148.75.231.53:443
73.136.242.114:443
108.30.125.94:443
71.217.125.53:2222
95.76.109.181:443
24.128.117.95:443
71.88.104.107:443
71.220.200.82:2222
65.102.149.94:995
75.189.159.193:443
69.123.116.167:2222
116.240.76.97:0
71.197.126.250:443
50.29.166.232:995
93.113.177.152:443
45.46.53.140:2222
96.37.113.36:993
24.28.183.107:995
74.195.88.59:995
189.157.199.133:995
66.76.105.197:443
68.184.45.73:443
68.104.6.221:993
96.237.141.134:995
75.82.182.228:2222
201.103.77.54:443
156.222.102.252:443
1.172.94.252:443
71.218.58.245:443
70.164.37.205:995
71.56.53.127:443
207.255.161.8:993
72.36.59.46:2222
98.240.24.57:443
99.240.226.2:443
69.11.247.242:443
65.30.213.13:6882
71.187.170.235:443
207.255.161.8:2078
207.255.161.8:32100
68.174.15.223:443
50.244.112.10:995
187.206.78.150:995
98.22.65.76:443
68.174.9.179:443
67.209.195.198:443
72.204.242.138:465
59.26.204.144:443
75.81.25.223:443
50.232.172.114:443
184.180.157.203:2222
24.231.54.185:2222
50.244.112.106:443
189.231.196.236:443
50.104.68.223:443
75.136.26.147:443
209.137.209.163:995
37.210.186.213:61201
Targets
-
-
Target
8b3bfff65aa4aa9abbc366ce6d9cc239_JaffaCakes118
-
Size
1.2MB
-
MD5
8b3bfff65aa4aa9abbc366ce6d9cc239
-
SHA1
77e69b99e1823a5bc47fa8e395c272a7121f8680
-
SHA256
9adfaa5b63a6a5456740d383e463055f47b796114675f0912e185638ad135d4a
-
SHA512
ad845060c75ceee146cd1d3d4813774acd19a73b7139a297344ecd44116fefa4590109eae3376c1cbab97580b167e08754de91e951f143ac923258c868638464
-
SSDEEP
6144:qsHHUPFY76DEoS5rYU/LPlbuo2YILNkFVZ5VfUllOp2n2FxHot1WL+Lwb5tJRJ:cs6AoS5EU/Lp56kBgXOInmNouL+Lwb5r
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-