General
-
Target
JaffaCakes118_589d9f95844f0af1f4c6278c95c8cfcbb58aa424d4eee3950c19458d57ac674a
-
Size
192KB
-
Sample
241225-drkzwswldv
-
MD5
201fbc67e5c9d05c96c7bb70f1939b20
-
SHA1
ba43745f411f53fed77e91dc96f4d0c753a44e52
-
SHA256
589d9f95844f0af1f4c6278c95c8cfcbb58aa424d4eee3950c19458d57ac674a
-
SHA512
0d608f13fed2870013c08fb8ef0da757f0dd1e960b8727741fee06052f72000551474276ded425d466f38a661844aff6b7f2c288a1e45a1ce7bbed3c4ad25e80
-
SSDEEP
3072:++STW8djpN6izj8mZwdJqutB+YDpqIPu/i9bVK2c/UAFS6+Wp7:j8XN6W8mmHPtppXPSi9b4hU
Behavioral task
behavioral1
Sample
JaffaCakes118_589d9f95844f0af1f4c6278c95c8cfcbb58aa424d4eee3950c19458d57ac674a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_589d9f95844f0af1f4c6278c95c8cfcbb58aa424d4eee3950c19458d57ac674a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot1816982056:AAGxKLt83DWYOT7VkzcIUl9WRfTHTU77Zf4/sendMessage?chat_id=1390277554
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
JaffaCakes118_589d9f95844f0af1f4c6278c95c8cfcbb58aa424d4eee3950c19458d57ac674a
-
Size
192KB
-
MD5
201fbc67e5c9d05c96c7bb70f1939b20
-
SHA1
ba43745f411f53fed77e91dc96f4d0c753a44e52
-
SHA256
589d9f95844f0af1f4c6278c95c8cfcbb58aa424d4eee3950c19458d57ac674a
-
SHA512
0d608f13fed2870013c08fb8ef0da757f0dd1e960b8727741fee06052f72000551474276ded425d466f38a661844aff6b7f2c288a1e45a1ce7bbed3c4ad25e80
-
SSDEEP
3072:++STW8djpN6izj8mZwdJqutB+YDpqIPu/i9bVK2c/UAFS6+Wp7:j8XN6W8mmHPtppXPSi9b4hU
-
Asyncrat family
-
StormKitty payload
-
Stormkitty family
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1