General
-
Target
98a374b7acd39cf3e785ef5d31743e88_JaffaCakes118
-
Size
295KB
-
Sample
240815-c81w1awbln
-
MD5
98a374b7acd39cf3e785ef5d31743e88
-
SHA1
8b58fd7f66b15c48c87c6228e1bf6888c5349372
-
SHA256
41f37d08fe0ebacaa087bdcb4f78a57752bb39e5bfd7399b9dc680977d855691
-
SHA512
c9fd30288bd8e9a5617123e77c492316cca5d270b215c11414b4ab6168fb7961ada568d2a7c481db7b69e50d61064ccb436b99806748f02c1a00142f77ebb3bd
-
SSDEEP
6144:o7R7fq2ByuEleJhurSNU3HmaGwwC1D6Y6ScCT4s9ohvLauDFaM:MfPkXQJhurSNU2FwwC1WD7ax
Static task
static1
Behavioral task
behavioral1
Sample
98a374b7acd39cf3e785ef5d31743e88_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
98a374b7acd39cf3e785ef5d31743e88_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://becharnise.ir/fb2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
98a374b7acd39cf3e785ef5d31743e88_JaffaCakes118
-
Size
295KB
-
MD5
98a374b7acd39cf3e785ef5d31743e88
-
SHA1
8b58fd7f66b15c48c87c6228e1bf6888c5349372
-
SHA256
41f37d08fe0ebacaa087bdcb4f78a57752bb39e5bfd7399b9dc680977d855691
-
SHA512
c9fd30288bd8e9a5617123e77c492316cca5d270b215c11414b4ab6168fb7961ada568d2a7c481db7b69e50d61064ccb436b99806748f02c1a00142f77ebb3bd
-
SSDEEP
6144:o7R7fq2ByuEleJhurSNU3HmaGwwC1D6Y6ScCT4s9ohvLauDFaM:MfPkXQJhurSNU2FwwC1WD7ax
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-