General
-
Target
9f046bf891c55cb358cc4f1c25892a12_JaffaCakes118
-
Size
311KB
-
Sample
240816-td291stbrg
-
MD5
9f046bf891c55cb358cc4f1c25892a12
-
SHA1
94142e8d8eeee0952bcdd1dd3ff87be2decddd1d
-
SHA256
0e834bafb88b050fa0c9f41ba37c204ce3cf1aa68fa3793ab607d46c7fbd8f89
-
SHA512
11b629dad3c7d0fcb42043e7c826270b307b5ee3346b050c402e7d77f3a16abd5960045ad68260953c1f96d178649b0f3de701de313612217699c9c2f52dda7a
-
SSDEEP
6144:0qjIctnTweYo9pNREL3qAUhQSeMU0iUykt:hxweYgbEeDCMU0iUl
Static task
static1
Behavioral task
behavioral1
Sample
9f046bf891c55cb358cc4f1c25892a12_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9f046bf891c55cb358cc4f1c25892a12_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
zjvb5chyh04at.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
zjvb5chyh04at.dll
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/fA33po5ZHfzav
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
9f046bf891c55cb358cc4f1c25892a12_JaffaCakes118
-
Size
311KB
-
MD5
9f046bf891c55cb358cc4f1c25892a12
-
SHA1
94142e8d8eeee0952bcdd1dd3ff87be2decddd1d
-
SHA256
0e834bafb88b050fa0c9f41ba37c204ce3cf1aa68fa3793ab607d46c7fbd8f89
-
SHA512
11b629dad3c7d0fcb42043e7c826270b307b5ee3346b050c402e7d77f3a16abd5960045ad68260953c1f96d178649b0f3de701de313612217699c9c2f52dda7a
-
SSDEEP
6144:0qjIctnTweYo9pNREL3qAUhQSeMU0iUykt:hxweYgbEeDCMU0iUl
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
fccff8cb7a1067e23fd2e2b63971a8e1
-
SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91
-
SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
-
SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
SSDEEP
192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score3/10 -
-
-
Target
zjvb5chyh04at.dll
-
Size
11KB
-
MD5
498ef70f50583187d76608713afaa102
-
SHA1
095a7366542b29b6ff5fe27e80bbfc1984ea7d4d
-
SHA256
0e6e593ac3d1f1ea997e4e7902b04a3657cbd048a6acfbe163a9139eef5d27f8
-
SHA512
baebe5efc6a3e90908ee0d6b8ab2612def333ad888025e65b61e05681ea73e13674ed87980add60a28a5f3a29be0954490485886770d5958538ee2f5bba752a6
-
SSDEEP
192:jH3dW30dtmS2rSidCmD3TAZ7PukQurM0+b1pH45SNdxNoIBqnn:4OUrYrZ7oSib/YY
Score3/10 -