General
-
Target
d52a5186281da29e0235517f66494574_JaffaCakes118
-
Size
104KB
-
Sample
240908-1ykc9sxejr
-
MD5
d52a5186281da29e0235517f66494574
-
SHA1
299c006ffcd4c4866f87a6d740e982f9b8f6acfe
-
SHA256
b936eac2c725e88aa40b1c97d001c594eec522adb73b7a793db3666527e11ddc
-
SHA512
f6b1ffd83ca117ce401987d7f0ae114f504ecb2d87b3757d843436298bcea3da06f28c69865fb283ebabdac004c0028bfa95d458c2a8c6dd58dacc3b03305810
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Behavioral task
behavioral1
Sample
d52a5186281da29e0235517f66494574_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d52a5186281da29e0235517f66494574_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://www.mcjessy.com/js/wipjessy/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
d52a5186281da29e0235517f66494574_JaffaCakes118
-
Size
104KB
-
MD5
d52a5186281da29e0235517f66494574
-
SHA1
299c006ffcd4c4866f87a6d740e982f9b8f6acfe
-
SHA256
b936eac2c725e88aa40b1c97d001c594eec522adb73b7a793db3666527e11ddc
-
SHA512
f6b1ffd83ca117ce401987d7f0ae114f504ecb2d87b3757d843436298bcea3da06f28c69865fb283ebabdac004c0028bfa95d458c2a8c6dd58dacc3b03305810
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-