General
-
Target
eef3355677cedcf0b4ddc3a4158e36f2_JaffaCakes118
-
Size
208KB
-
Sample
240921-dhgacasbnq
-
MD5
eef3355677cedcf0b4ddc3a4158e36f2
-
SHA1
46037dcfb9421b611769f2d133f3c69787d18b22
-
SHA256
977a51ee8ca1bb6b29b806fb210ff63828909fae364e8391be82f5f732e9dd81
-
SHA512
81dd518d32adb2137a05c0ae17743ce90b8b79a474552730f4ffb05395174a12f3b607b7571b0ce82fa7ba72d71d0c571261646b5a1cdda4fa5132a0301936fd
-
SSDEEP
3072:SChJgYMm4xf9cU9KQ2BxA59SPMGOorn2C:qYMm4xiWKQ2BiCMi
Static task
static1
Behavioral task
behavioral1
Sample
eef3355677cedcf0b4ddc3a4158e36f2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eef3355677cedcf0b4ddc3a4158e36f2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
eef3355677cedcf0b4ddc3a4158e36f2_JaffaCakes118
-
Size
208KB
-
MD5
eef3355677cedcf0b4ddc3a4158e36f2
-
SHA1
46037dcfb9421b611769f2d133f3c69787d18b22
-
SHA256
977a51ee8ca1bb6b29b806fb210ff63828909fae364e8391be82f5f732e9dd81
-
SHA512
81dd518d32adb2137a05c0ae17743ce90b8b79a474552730f4ffb05395174a12f3b607b7571b0ce82fa7ba72d71d0c571261646b5a1cdda4fa5132a0301936fd
-
SSDEEP
3072:SChJgYMm4xf9cU9KQ2BxA59SPMGOorn2C:qYMm4xiWKQ2BiCMi
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-