General
-
Target
f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118
-
Size
557KB
-
Sample
240926-nfdfsaxemh
-
MD5
f84217da36243f2f84ac59ef8b7a335c
-
SHA1
0db32208d2c6c43caa2c5f7030812521a749e91f
-
SHA256
f43704733fbb8efbc457bb922c529df7e358cd26f7d99f0ec4c4cbb748d816d1
-
SHA512
d247f517e8cf1cc93170b8c38c9a95e1797669478f7f7d65f9e13f3ff66b5995557ab86abb763a7208517a8033e4a708fca241d2f1ef257fadcedd6a73c7edd4
-
SSDEEP
6144:Zst++SoUwNSXqzvAaYhwOA2WGxa+7OTLubgabY03HEw5v+HEzK/bxQh9lp2E9Th0:6fXSaD50/AdNT6bi03Hv+YEyjJ1Zm
Static task
static1
Behavioral task
behavioral1
Sample
f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
2.1.0.0
Office04
127.0.0.1:4782
VNM_MUTEX_iRne81OIv7xHkBnmxo
-
encryption_key
btGyLN1mMyjkKPSibgiM
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118
-
Size
557KB
-
MD5
f84217da36243f2f84ac59ef8b7a335c
-
SHA1
0db32208d2c6c43caa2c5f7030812521a749e91f
-
SHA256
f43704733fbb8efbc457bb922c529df7e358cd26f7d99f0ec4c4cbb748d816d1
-
SHA512
d247f517e8cf1cc93170b8c38c9a95e1797669478f7f7d65f9e13f3ff66b5995557ab86abb763a7208517a8033e4a708fca241d2f1ef257fadcedd6a73c7edd4
-
SSDEEP
6144:Zst++SoUwNSXqzvAaYhwOA2WGxa+7OTLubgabY03HEw5v+HEzK/bxQh9lp2E9Th0:6fXSaD50/AdNT6bi03Hv+YEyjJ1Zm
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-