General
-
Target
cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118
-
Size
3.4MB
-
Sample
240831-3e9j6a1hja
-
MD5
cdcc0ad2446684e736fa5813caee0a57
-
SHA1
21aad2f791e2c12deed221484ff00ed8a0edb799
-
SHA256
6ef09a9d766a9ca209da5fc075de5c3e7152c3f49e88bb2db61e061f0bd2184d
-
SHA512
6d17654a61116fab4b0b1128699dbbf2751d63e78615f822452a9a1ebe62889df401ed1ba795a04535446c86d4b122036f346e8744e6ac15d6e9c8a1240ec6c2
-
SSDEEP
98304:lnbDOSv7J7SvNZZToTcMBailCO3QBKGFqL9z/2MSbB:xOKF7SJToAMU8uBK2qL9ZSF
Behavioral task
behavioral1
Sample
cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118
-
Size
3.4MB
-
MD5
cdcc0ad2446684e736fa5813caee0a57
-
SHA1
21aad2f791e2c12deed221484ff00ed8a0edb799
-
SHA256
6ef09a9d766a9ca209da5fc075de5c3e7152c3f49e88bb2db61e061f0bd2184d
-
SHA512
6d17654a61116fab4b0b1128699dbbf2751d63e78615f822452a9a1ebe62889df401ed1ba795a04535446c86d4b122036f346e8744e6ac15d6e9c8a1240ec6c2
-
SSDEEP
98304:lnbDOSv7J7SvNZZToTcMBailCO3QBKGFqL9z/2MSbB:xOKF7SJToAMU8uBK2qL9ZSF
-
StormKitty payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook profiles
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-