General
-
Target
0df1ad10b10d11c6013d7d83b4278eb9_JaffaCakes118
-
Size
213KB
-
Sample
241003-e61jkavdmm
-
MD5
0df1ad10b10d11c6013d7d83b4278eb9
-
SHA1
af3dcfaf567e1de5124d06fded43fb8116e91822
-
SHA256
fede770cb9060e49a28a8459bb28f32bed095ab99d9b80eaf9e3c0ff7658dab2
-
SHA512
dcc8a0b99a2dc75140adafb8db4ac4b9726c70e5e7f15840d5f573976113b1cef9874a0889e65b7ad429226f5d07a8bd7003ea02fb5effe5d0ec57a7ac2f67ed
-
SSDEEP
3072:oChJgYMm4xf9cU9KQ2BxA59SPMqOo1n2X:4YMm4xiWKQ2BiCMR
Static task
static1
Behavioral task
behavioral1
Sample
0df1ad10b10d11c6013d7d83b4278eb9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0df1ad10b10d11c6013d7d83b4278eb9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
0df1ad10b10d11c6013d7d83b4278eb9_JaffaCakes118
-
Size
213KB
-
MD5
0df1ad10b10d11c6013d7d83b4278eb9
-
SHA1
af3dcfaf567e1de5124d06fded43fb8116e91822
-
SHA256
fede770cb9060e49a28a8459bb28f32bed095ab99d9b80eaf9e3c0ff7658dab2
-
SHA512
dcc8a0b99a2dc75140adafb8db4ac4b9726c70e5e7f15840d5f573976113b1cef9874a0889e65b7ad429226f5d07a8bd7003ea02fb5effe5d0ec57a7ac2f67ed
-
SSDEEP
3072:oChJgYMm4xf9cU9KQ2BxA59SPMqOo1n2X:4YMm4xiWKQ2BiCMR
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-