Overview

overview

10

Static

static

3

ba448e9af2...18.exe

windows7-x64

10

ba448e9af2...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ba448e9af265fd0be041bcd124da35e7_JaffaCakes118

  • Size

    196KB

  • Sample

    240823-ej4ygawgll

  • MD5

    ba448e9af265fd0be041bcd124da35e7

  • SHA1

    c1c2f430daf6e7bb39428938abf474d5460eebe0

  • SHA256

    77c4f554be4332950304b25e782b69d3e807dcb01905892a68f2ca1678094b7a

  • SHA512

    cb0050b0c95e141433a8086517816565bda78a15dd15ec97b071b9bafc2cf739bd853269a94fc3fa57228267a78cde370833370f3504c5ccb58dd331fb84b9b1

  • SSDEEP

    1536:aXscdri741fT/dQVJnsuv77P1Vg6u8jGZofgbd87:aXpdr1f5QrnssP1Vg6KofgxK

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.ueuo.com
  • Port:
    21
  • Username:
    googgle.ueuo.com
  • Password:
    741852

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.alizametal.com.tr
  • Port:
    21
  • Username:
    alizametal.com.tr
  • Password:
    hd611

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.yesimcopy.com
  • Port:
    21
  • Username:
    yesimcopy1
  • Password:
    825cyf

Targets

    • Target

      ba448e9af265fd0be041bcd124da35e7_JaffaCakes118

    • Size

      196KB

    • MD5

      ba448e9af265fd0be041bcd124da35e7

    • SHA1

      c1c2f430daf6e7bb39428938abf474d5460eebe0

    • SHA256

      77c4f554be4332950304b25e782b69d3e807dcb01905892a68f2ca1678094b7a

    • SHA512

      cb0050b0c95e141433a8086517816565bda78a15dd15ec97b071b9bafc2cf739bd853269a94fc3fa57228267a78cde370833370f3504c5ccb58dd331fb84b9b1

    • SSDEEP

      1536:aXscdri741fT/dQVJnsuv77P1Vg6u8jGZofgbd87:aXpdr1f5QrnssP1Vg6KofgxK

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks