General
-
Target
aa7fbd05a1fe5d4a0c68e0f24ca55cb2_JaffaCakes118
-
Size
4.2MB
-
Sample
240819-llkqyazemp
-
MD5
aa7fbd05a1fe5d4a0c68e0f24ca55cb2
-
SHA1
097990eab583a7060776a068996a0cf02939feba
-
SHA256
d705b4cfd6e8b2c77fc358d1b5ff2cf34e26876743a69b38015a4484c73fad45
-
SHA512
bd04c689c83147f90c0b46a280614f335269f3751257ea7115d4b98205bcd11ff3c1a84340b73d5eac5a37b3485e68275b273e9d162152313ae55f4f9ab61bc9
-
SSDEEP
6144:DWYmFNuwc2U+5SER2z4sMJzSoVgxs67kOksDO9lOuo+PpJ:DWNIwHUgR20sM8k24
Static task
static1
Behavioral task
behavioral1
Sample
aa7fbd05a1fe5d4a0c68e0f24ca55cb2_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
qakbot
325.43
abc009
1601288915
67.60.113.253:2222
93.149.253.201:2222
47.44.217.98:443
151.76.220.137:443
117.218.208.239:443
190.30.185.80:443
71.80.66.107:443
195.162.106.93:2222
80.14.209.42:2222
50.244.112.106:443
184.98.103.204:995
74.109.219.145:443
79.118.76.109:443
72.186.1.237:443
41.34.85.231:995
90.175.88.99:2222
84.232.238.30:443
45.32.155.12:443
73.104.218.229:0
98.26.50.62:995
73.228.1.246:443
65.131.33.110:995
89.42.142.35:443
77.46.172.129:995
2.50.59.177:443
86.163.174.11:2222
203.198.96.200:443
71.220.191.200:443
24.218.181.15:443
72.28.255.159:995
96.41.93.96:443
172.113.152.27:443
108.46.145.30:443
199.247.22.145:443
2.7.65.32:2222
207.255.161.8:993
108.31.15.10:995
2.90.183.133:995
184.97.132.62:443
39.37.244.25:995
89.137.211.239:443
95.219.146.137:443
200.75.136.78:443
74.75.237.11:443
199.116.241.147:443
86.98.74.44:995
216.201.162.158:443
71.126.139.251:443
81.133.234.36:2222
103.76.160.110:443
77.27.174.49:995
172.78.30.215:443
213.67.45.195:2222
2.90.120.199:995
86.183.127.100:2222
207.246.75.201:443
45.77.193.83:443
89.33.87.107:443
208.99.100.129:443
86.97.161.201:443
146.200.250.36:2222
95.77.223.148:443
80.195.103.146:2222
144.139.47.206:443
184.180.157.203:2222
217.162.149.212:443
71.19.217.23:443
50.29.166.232:995
108.5.34.248:443
75.136.40.155:443
207.237.1.152:443
2.51.221.138:995
96.30.198.161:443
199.247.16.80:443
207.255.161.8:995
45.32.154.10:443
72.66.47.70:443
175.211.225.118:443
72.204.242.138:50001
37.105.114.113:443
103.206.112.234:443
83.110.6.64:2222
188.27.66.202:443
68.46.142.48:995
2.186.227.245:995
46.53.60.101:443
151.73.116.80:443
203.106.195.67:443
95.179.247.224:443
75.137.239.211:443
141.158.47.123:443
59.96.167.179:443
207.255.161.8:443
85.185.202.195:995
74.56.167.31:443
173.245.152.231:443
85.122.141.42:995
185.19.190.81:443
80.240.26.178:443
59.26.204.144:443
5.15.90.159:2222
36.77.151.211:443
37.107.86.147:995
81.103.144.77:443
70.124.29.226:443
84.117.176.32:443
115.218.168.199:995
5.12.0.239:443
47.138.201.136:443
94.52.160.116:443
111.241.130.63:443
213.31.203.109:2222
203.45.104.33:443
85.186.115.219:995
66.44.110.198:443
84.117.60.157:443
5.12.218.57:2222
95.76.109.181:443
108.30.125.94:443
5.14.115.219:443
73.200.219.143:443
89.176.37.202:995
173.21.10.71:2222
67.6.55.77:443
65.102.149.94:995
45.46.53.140:2222
71.197.126.250:443
205.178.7.90:443
72.223.123.155:443
73.232.165.200:995
74.195.88.59:995
66.25.168.167:2222
24.188.48.139:443
71.217.125.53:2222
69.47.239.10:443
189.183.74.198:995
68.104.6.221:443
207.255.18.67:443
66.208.105.6:443
24.128.117.95:443
73.32.115.251:443
24.255.176.233:443
66.97.247.15:443
73.23.194.75:443
71.218.58.245:443
71.74.12.34:443
173.173.1.164:443
70.92.123.49:443
99.195.113.168:443
75.136.26.147:443
Targets
-
-
Target
aa7fbd05a1fe5d4a0c68e0f24ca55cb2_JaffaCakes118
-
Size
4.2MB
-
MD5
aa7fbd05a1fe5d4a0c68e0f24ca55cb2
-
SHA1
097990eab583a7060776a068996a0cf02939feba
-
SHA256
d705b4cfd6e8b2c77fc358d1b5ff2cf34e26876743a69b38015a4484c73fad45
-
SHA512
bd04c689c83147f90c0b46a280614f335269f3751257ea7115d4b98205bcd11ff3c1a84340b73d5eac5a37b3485e68275b273e9d162152313ae55f4f9ab61bc9
-
SSDEEP
6144:DWYmFNuwc2U+5SER2z4sMJzSoVgxs67kOksDO9lOuo+PpJ:DWNIwHUgR20sM8k24
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-