General
-
Target
cae33d6a0788633ef6263601d9c5f303_JaffaCakes118
-
Size
88KB
-
Sample
241206-ed1nvsvjfm
-
MD5
cae33d6a0788633ef6263601d9c5f303
-
SHA1
184a50f039f7685b75ceb0fbab2b748483bf91cd
-
SHA256
ae66cfbf795516ba8c7df1ae2386419df98a2da03fccb70f6cae260219ccc975
-
SHA512
e7d8b998449d608bdba4448abaaa8e73bf011fc0e3f24c09579c1640b1ee03ab2ffc0e65395bb0784616181a619a60ee463c0d55aefa07a94b8196d31ea8ee47
-
SSDEEP
1536:t5piVnDXkTbhCtaB6GVA/bVQPxfgiqfoOonoKg+yOH5y/yE8:6D0ctAVA/bmxIMnoKjyR/N8
Static task
static1
Behavioral task
behavioral1
Sample
cae33d6a0788633ef6263601d9c5f303_JaffaCakes118.exe
Resource
win7-20241010-en
Malware Config
Targets
-
-
Target
cae33d6a0788633ef6263601d9c5f303_JaffaCakes118
-
Size
88KB
-
MD5
cae33d6a0788633ef6263601d9c5f303
-
SHA1
184a50f039f7685b75ceb0fbab2b748483bf91cd
-
SHA256
ae66cfbf795516ba8c7df1ae2386419df98a2da03fccb70f6cae260219ccc975
-
SHA512
e7d8b998449d608bdba4448abaaa8e73bf011fc0e3f24c09579c1640b1ee03ab2ffc0e65395bb0784616181a619a60ee463c0d55aefa07a94b8196d31ea8ee47
-
SSDEEP
1536:t5piVnDXkTbhCtaB6GVA/bVQPxfgiqfoOonoKg+yOH5y/yE8:6D0ctAVA/bmxIMnoKjyR/N8
-
Andromeda family
-
Detects Andromeda payload.
-
Adds policy Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-