�˿��\o����;��Q���됤���A���.OH3�F�죱�a�f����N��]�*��Ǚr9������Ɉ�=~�fQ�KF�@�+D�}韊��a֛$�j][t����N����%L�ƭi-el�+<%�r߃IC������.'�*��Tkia�n;�Y��f��4H9ذ��HQ��ӕXSo��PDvX��F��JGz����rW��i������N����~WSS � vnf�a�L��a�k���g����g��2;�X��gғ�F�.1eϭ��aK㥼hHw�c�Z��`������I���QF���_����N/O*V�\��ڝw�<�o[���D�!�lT�T<L�(gY�s�[�.�/�������������_]L5�`kvQ;��W��n�QLC>\�/Ƌ!ryZ��+�,s]�o��G��q؍�<۳nZ��i����6�eM��9e��{�{������n5�$ޘ,��Q�r�Ȳo�0>G�����O����RP�Z'�]����4�S��D� ���[%�u=�%��߅�����2q\C�M2��a�҇8s2*��R��e�������?*|�(k����hj$� �f~������!�l�@zOxō��&Q ��m����<�q�%��:Xrc�V�2=<����nO��-���R�@8:� �x�K�!̜ā���oD�\���K�䳕�#�ZH�'e�"Y�yZ:s��z�q3�Fv�pe���ءc���W�����Ю�L�ƣ��4I�?�������f��~JD� ,7�hg��I�i`����F�V�#}�)SڑnC�,��M>L櫫#Z�r+������G�D�>���^�Ig&R pu�[Z�@���j�lF&v�Q�goZv���N�\ׂ�GTټ���n ��:����Qx�d��Ĵ�� AԻ��2���z�cU���|��+i�e��q��qo��������?��y��|C`OII�HH���W�wݰYp�W��>zqng�U5ɗC������ޱ���w�cX�=�Xzh˂���'�d�^�7��g5��Ǵ�Z���6�ˮKT,"� �7�M��?aѰ�����n��- �� r^ -����Yu����./�"q�B���."^�z�,Ko�"3ޤs�C�s�Z��Q��t[�?����!�g\�v*�0ML�g�� ��'!J��������ЇO�GC��d6L�s�A�����{UT��¤��U��݇B!��@G��nrI��v���T���}9ȳ�|��AR��\j`�!�S�uJ��u��ux��`��=>�,���I� %���W�������猿�9,=+<���3�mޡ�S��oetJO-v&+wҙ�(`k�V@�������>�+ɚ�0�&+Ӣ�� ��KS�>�����=v�>*�.�:�:�f��G�cZ>�ȷ1�`��!�A ���SW ů�OW�čD?��� b����̣ �����p�4�R��z%�b���HF�=�I�ڣ2y��m��o3��<0]���3{�'0K�����V���� ^��r�v�$^+� �����z��t��4����g��Ei�ʝ��k�=`Y)R�a1~$i.PFb< h�FJ:�\^< yv_.�ڬ�՚��j�?��D$����`0�G��4�δ'��1P��Irnq��}���`�� %�:Z>�Ag���s-Z���;�vޖ�3!�g�����E������~Ȥ��d��n�����V��iL� ~��K����}��m�������R����ja���Dlz�`頡Q�:+>Jy�V�6@Pu8-aW�"���� ��������\�/C��85�)Y"����[�3��h=��A��ݹ̲<�4"�ݣu���5�HT��,)[�t��lﺫGVH,B�'w�3���� �U��<��;��ݺ�vS�_���>oȰ,T��YI�� �� ���A604��/;�<>-�3$>4�)��}Q�*�%��Y�C�"���h��_����ԞԮ����ҷ�$�W@���_ ͈�+-(�B/Ї/�?����*��Kf��3����@T>n��t.��D$��n�S\�M�|D��8�+����$_f�̅)M�>�J������y���H������~8�I$�0>��_m�חd`��� *S�nV8�B���LJ-���v��>e���8^�j@D.�d��J1]ӆU> �tv�\b&� p܃���bUvxRA��@���gY��l���#���0Ʃ"�Jt=~$u��G�!F;(��}J��M��cԓ.h[�q>d~�ܿ��dR��>����~*l�U^C6�$t���N�D=�*��ɸ�����Vt~Le�nB_�t��3[F���|���j��(�*;UN�d1�e��̳��h[`�1���W�]��<�^��l����2�N���J ^M��,���p���f �ͣ�L��aF��3���I�2��#/��1f�)m�EyC�����~+:M���[�w|�,"����`�k��\��y��Ң��NRLJQ�Fv6���e��6�CC�����#��e���N?���w4����[���)��@|��y�iMJ�6���a�^#��2 YI�|��ι4D&)$o�N$6��e���H����a�s��/��� �$�-�S�@�*� з�:+&�Uj����wC`�=*��uu�.��H5�e�T\DP��e����6�րO�M�4�,I�\�qn�P�>���Sn��Z�27������3�,��8sؓ������;3w�I�n+��!R �sX=�u����w�:Lvz����}�W�&��q�������FLz�欣j���T7P���p�)�������ʕb�DZ��)T똦�ìe�ڡ{�]R� ��d��V,<�������՜z����W �k)B��%�cm#��N���Po5�����5�DW�c��B;���C23j:����Z�&�v��ւ�t����.���v��<� y�Ҧ�6��x����L 2�X:�}@"��$�p�֩��K=X0~���n�2���uGrx�x��°u��b�=;�)��9������7w�j�|K�*ɉ5�4�m�
Static task
static1
Behavioral task
behavioral1
Sample
cfg/etBot_default.vbs
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cfg/etBot_default.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
cfg/etBot_names.ps1
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
cfg/etBot_names.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
etBot.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
etBot.exe
Resource
win10v2004-20241007-en
General
-
Target
2da88aee7dee64d55d31aa372c526546_JaffaCakes118
-
Size
1.2MB
-
MD5
2da88aee7dee64d55d31aa372c526546
-
SHA1
f7f1ad40b0c7006d5e2b882e78a0c29c4ae10946
-
SHA256
acd14c2bc883b056adcfad1d5f68604aca3132388288e044d1e3c71e4d959f50
-
SHA512
4dcdbeca91f033079555ef694bc5ae5cc3dda4999bbcf436472455a60626cf9e2694380944be0707dc043eac2bab5a5a80373b5ea74a60e9a6ce76511223d523
-
SSDEEP
24576:lagr8T3hrd/Ad+zg9or57TlpXv1CWU3ySYBV/mOYoYyRzRG:lxoTxZ/As09or5/lve3y5/VfzRG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/etBot.exe
Files
-
2da88aee7dee64d55d31aa372c526546_JaffaCakes118.zip
-
cfg/etBot_default.cfg.vbs
-
cfg/etBot_menu.txt
-
cfg/etBot_names.txt.ps1
-
etBot.exe.exe windows:5 windows x86 arch:x86
06a46c31409a267617aa10df3d96e526
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindow
MessageBoxA
advapi32
RegQueryValueExA
shell32
SHGetFolderPathA
ws2_32
WSACleanup
Exports
Exports
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nc0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nc1 Size: - Virtual size: 375KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nc2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
etBot.ini
-
readme.txt