Static task
static1
Behavioral task
behavioral1
Sample
sdnbbot_[sp2mod]_wks_kelvir/sources/autostart.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sdnbbot_[sp2mod]_wks_kelvir/sources/autostart.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
sdnbbot_[sp2mod]_wks_kelvir/sources/taskhider.js
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
sdnbbot_[sp2mod]_wks_kelvir/sources/taskhider.js
Resource
win10v2004-20240802-en
General
-
Target
0b2cf10a0173f301510f34745ffe925d_JaffaCakes118
-
Size
81KB
-
MD5
0b2cf10a0173f301510f34745ffe925d
-
SHA1
dacf20f6f5a81a5a61e6b25d5a399d6f827d6dd5
-
SHA256
b1a0daf15e592c30f873937ded4b99496801270c03c6e0720102fa096c1dbf07
-
SHA512
ffe0fc5c479ea5c3c9b59bf95f14ee386658b2fdd00470a5728c17444d56643aad991775b4ce5cd48ac82d601d9346c89949db62c8fee1a8fc2072d8e93bfc3e
-
SSDEEP
1536:8KaqcCiliMuoXXzNRNGMDgK8R0cKq6K212co+gFuauscXGylQ5w0eYQjYwK:9xWXDNbGMkKa0czco+gu8x5wUQjXK
Malware Config
Signatures
Files
-
0b2cf10a0173f301510f34745ffe925d_JaffaCakes118.rar
-
sdnbbot_[sp2mod]_wks_kelvir/config.h
-
sdnbbot_[sp2mod]_wks_kelvir/credits.txt
-
sdnbbot_[sp2mod]_wks_kelvir/includes/advscan.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/aliaslog.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/autostart.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/avirus.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/dcom.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/dcom135lsass.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/ddos.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/defines.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/dns.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/download.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/driveinfo.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/extern.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/fphost.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/ftpd.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/functions.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/hostauth.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/icmpflood.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/identd.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/includes.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/irc_send.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/kazaa.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/kelvir.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/loaddll.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/lsass.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/misc.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/mssql.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/netbios.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/netheaders.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/netutils.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/passwd.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/processes.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/redirect.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/rndnick.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/sasser.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/sdbot05b.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/shellcode.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/skysyn.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/socks.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/taskhider.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/tcpip.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/tftpd.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/threads.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/visit.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/wks.h
-
sdnbbot_[sp2mod]_wks_kelvir/includes/wkssvc.h
-
sdnbbot_[sp2mod]_wks_kelvir/sdbot05b.dsp
-
sdnbbot_[sp2mod]_wks_kelvir/sdbot05b.dsw
-
sdnbbot_[sp2mod]_wks_kelvir/sources/advscan.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/aliaslog.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/autostart.cpp.vbs
-
sdnbbot_[sp2mod]_wks_kelvir/sources/avirus.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/dcom.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/dcom135lsass.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/ddos.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/dns.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/download.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/driveinfo.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/fphost.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/ftpd.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/hostauth.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/icmpflood.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/identd.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/irc_send.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/kelvir.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/loaddll.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/lsass.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/misc.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/mssql.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/netbios.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/netutils.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/processes.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/redirect.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/rndnick.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/sasser.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/scan.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/sdbot05b.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/shellcode.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/skysyn.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/socks.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/taskhider.cpp.js
-
sdnbbot_[sp2mod]_wks_kelvir/sources/tftpd.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/threads.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/visit.cpp
-
sdnbbot_[sp2mod]_wks_kelvir/sources/wks.CPP
-
sdnbbot_[sp2mod]_wks_kelvir/sources/wkssvc.cpp