Overview

overview

10

Static

static

3

3ef667d9b7...18.exe

windows7-x64

10

3ef667d9b7...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3ef667d9b7ac904d0e78a2f501521db0_JaffaCakes118

  • Size

    204KB

  • Sample

    241013-kz1tmsycjb

  • MD5

    3ef667d9b7ac904d0e78a2f501521db0

  • SHA1

    f369e9ea991e0b1b253e49c581ae3eb42f9bb0f3

  • SHA256

    107177148e0b632de09d45975368aa1cefb67685739b1a318ebb9ae825605515

  • SHA512

    c44e77f8eaf6cbac822c44e868a8cdfc4542f73ef1d1be572f592441ea964b91ad82c9d8ce44210a4fa4b77f872b78c9d3978dd02d459be008b3d897d324a026

  • SSDEEP

    1536:PfAiHwgicnislGltILYLU9KD02BBAdKJaPoYkwA4dIolx:PfQgicdlGvILcU9KQ2BBAkJaPxLIolx

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.byethost12.com
  • Port:
    21
  • Username:
    b12_8082975
  • Password:
    951753zx

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      3ef667d9b7ac904d0e78a2f501521db0_JaffaCakes118

    • Size

      204KB

    • MD5

      3ef667d9b7ac904d0e78a2f501521db0

    • SHA1

      f369e9ea991e0b1b253e49c581ae3eb42f9bb0f3

    • SHA256

      107177148e0b632de09d45975368aa1cefb67685739b1a318ebb9ae825605515

    • SHA512

      c44e77f8eaf6cbac822c44e868a8cdfc4542f73ef1d1be572f592441ea964b91ad82c9d8ce44210a4fa4b77f872b78c9d3978dd02d459be008b3d897d324a026

    • SSDEEP

      1536:PfAiHwgicnislGltILYLU9KD02BBAdKJaPoYkwA4dIolx:PfQgicdlGvILcU9KQ2BBAkJaPxLIolx

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks