General
-
Target
4719369301021c7fafd27809940a39e2_JaffaCakes118
-
Size
107KB
-
Sample
241015-lsxdba1gpr
-
MD5
4719369301021c7fafd27809940a39e2
-
SHA1
3ba8f49bfa4012a9c6a8037c1578591014fbbb99
-
SHA256
0a4662f9f759781f50cecb082c783d73cf78b388ee0904fd11286417879286e2
-
SHA512
bfa0921afcdb27a810466d68c9668cc0c7202a1e36a7bccf40cf3fd373ca2ee4043eb1f17a167fafab9a34b9af5170a62dc169478bce055373b9d001c8c9a9f8
-
SSDEEP
3072:O4tT+jKYgGT+0rREjSgM+Kgr9CCjQ3SWPA:OEyjKY5ngM+Kgr0+T
Behavioral task
behavioral1
Sample
4719369301021c7fafd27809940a39e2_JaffaCakes118.jar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4719369301021c7fafd27809940a39e2_JaffaCakes118.jar
Resource
win10v2004-20241007-en
Malware Config
Extracted
strrat
agadinwanyi.dubya.net:1788
agadinwanyi.dubya.net:1781
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Targets
-
-
Target
4719369301021c7fafd27809940a39e2_JaffaCakes118
-
Size
107KB
-
MD5
4719369301021c7fafd27809940a39e2
-
SHA1
3ba8f49bfa4012a9c6a8037c1578591014fbbb99
-
SHA256
0a4662f9f759781f50cecb082c783d73cf78b388ee0904fd11286417879286e2
-
SHA512
bfa0921afcdb27a810466d68c9668cc0c7202a1e36a7bccf40cf3fd373ca2ee4043eb1f17a167fafab9a34b9af5170a62dc169478bce055373b9d001c8c9a9f8
-
SSDEEP
3072:O4tT+jKYgGT+0rREjSgM+Kgr9CCjQ3SWPA:OEyjKY5ngM+Kgr0+T
Score10/10-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1