General
-
Target
6b16a229b3af43c100a1c8baae0b0d4f_JaffaCakes118
-
Size
4.2MB
-
Sample
240523-qq281adb54
-
MD5
6b16a229b3af43c100a1c8baae0b0d4f
-
SHA1
bc8b107ca7db60e94a36fd01908a853292025a9c
-
SHA256
1dd611fc80b9bbd697113ef3afe747edf5fe51e23b3c7407a29c65f753f1260d
-
SHA512
6aa3aa03ed24d75ea2fbbd2c9e6ad785032d3d23ca450ff467b61e793ca46cd71594027f1b990471ddaa867e4822fd52d059eeb9d0d6f655baf7c7e2ff9f747e
-
SSDEEP
98304:G0YVc8p/kHGJq2fMZggNR97ORwF5mBvoN0VH9zZDHnvVoZ0ljqNRYx:G078pPq64RURwbvN8HV1HnvVoZ4CRYx
Static task
static1
Behavioral task
behavioral1
Sample
6b16a229b3af43c100a1c8baae0b0d4f_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
cryptbot
nkoopw03.top
moraass06.top
Targets
-
-
Target
6b16a229b3af43c100a1c8baae0b0d4f_JaffaCakes118
-
Size
4.2MB
-
MD5
6b16a229b3af43c100a1c8baae0b0d4f
-
SHA1
bc8b107ca7db60e94a36fd01908a853292025a9c
-
SHA256
1dd611fc80b9bbd697113ef3afe747edf5fe51e23b3c7407a29c65f753f1260d
-
SHA512
6aa3aa03ed24d75ea2fbbd2c9e6ad785032d3d23ca450ff467b61e793ca46cd71594027f1b990471ddaa867e4822fd52d059eeb9d0d6f655baf7c7e2ff9f747e
-
SSDEEP
98304:G0YVc8p/kHGJq2fMZggNR97ORwF5mBvoN0VH9zZDHnvVoZ0ljqNRYx:G078pPq64RURwbvN8HV1HnvVoZ4CRYx
-
CryptBot payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-