General
-
Target
9d3c09a029f889e449d2abc0aab29fde_JaffaCakes118
-
Size
279KB
-
Sample
240816-gxkg4atdnn
-
MD5
9d3c09a029f889e449d2abc0aab29fde
-
SHA1
6292b1cdf3cca3028699598041f557073f1961c8
-
SHA256
4f020bad002a120bfe99665029e7f612f0278d4e2d548fc437201e5ac3372a86
-
SHA512
8c84c15604946572f1f6598553d5e1d1198cab783788214e06bf59b35715aa8088fe001cbc020aff290294015788b5136e9c6cada68f770420f4e5e9d48f998b
-
SSDEEP
6144:maDzULO+XXEyULkVRJzxiSETX6JgMqgyzROhxxpeTr/ekI:hDg9XXEKdiTSqgbzxp6L
Static task
static1
Behavioral task
behavioral1
Sample
9d3c09a029f889e449d2abc0aab29fde_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
9d3c09a029f889e449d2abc0aab29fde_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://checkvim.com/ga15/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
9d3c09a029f889e449d2abc0aab29fde_JaffaCakes118
-
Size
279KB
-
MD5
9d3c09a029f889e449d2abc0aab29fde
-
SHA1
6292b1cdf3cca3028699598041f557073f1961c8
-
SHA256
4f020bad002a120bfe99665029e7f612f0278d4e2d548fc437201e5ac3372a86
-
SHA512
8c84c15604946572f1f6598553d5e1d1198cab783788214e06bf59b35715aa8088fe001cbc020aff290294015788b5136e9c6cada68f770420f4e5e9d48f998b
-
SSDEEP
6144:maDzULO+XXEyULkVRJzxiSETX6JgMqgyzROhxxpeTr/ekI:hDg9XXEKdiTSqgbzxp6L
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-