General
-
Target
c0f1f20287896ff8a866a98497ed8123_JaffaCakes118
-
Size
4.6MB
-
Sample
240825-rxwv8sygla
-
MD5
c0f1f20287896ff8a866a98497ed8123
-
SHA1
c566997f3fd2a9a2c6a5b5d96d3c1f7e81d65f36
-
SHA256
36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019
-
SHA512
d1d867fdc84502f98901e006e803337abfee7c58b172913813132fdf9d8d125bb1ae304f35789ee3c836240344a81e3bbb132a024c9b03bb6a77550678228c76
-
SSDEEP
98304:Yi1FnwzTuf1TUBnuYlj+C6oes5+Pc+3PT1+Ai5ruELIUV0pIgKiNUn7MZT7pb:THnC8NUplvfesAE+3PBvQuEsU392xP
Static task
static1
Behavioral task
behavioral1
Sample
c0f1f20287896ff8a866a98497ed8123_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
bitrat
1.34
logonapplication.ddns.net:4010
-
communication_password
c4ca4238a0b923820dcc509a6f75849b
-
tor_process
tor
Targets
-
-
Target
c0f1f20287896ff8a866a98497ed8123_JaffaCakes118
-
Size
4.6MB
-
MD5
c0f1f20287896ff8a866a98497ed8123
-
SHA1
c566997f3fd2a9a2c6a5b5d96d3c1f7e81d65f36
-
SHA256
36cfad0772085523235d33687f8d8bdf460bcb468bcc3e885f719d61a99b7019
-
SHA512
d1d867fdc84502f98901e006e803337abfee7c58b172913813132fdf9d8d125bb1ae304f35789ee3c836240344a81e3bbb132a024c9b03bb6a77550678228c76
-
SSDEEP
98304:Yi1FnwzTuf1TUBnuYlj+C6oes5+Pc+3PT1+Ai5ruELIUV0pIgKiNUn7MZT7pb:THnC8NUplvfesAE+3PBvQuEsU392xP
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-