General
-
Target
132eb1a40c403bc96986024b3de63dbb_JaffaCakes118
-
Size
725KB
-
Sample
240626-yawehssfjk
-
MD5
132eb1a40c403bc96986024b3de63dbb
-
SHA1
52996e976b37b7ac2a53be90864b44e7d02c1974
-
SHA256
75f2d758f27b27982c84af9f9ad2677e005a72a385e48627dfa13341a4273606
-
SHA512
2757b1baba6e0d3253e7c2aca14020b739d368684f475b72ff4d470559f3626972f522ca30a7b30379d2b78df646b0f8299615758491b391b78b819be92f95e8
-
SSDEEP
12288:M9yCkuvgld21fNlRULtFkcmPMUHiMySw3Tznmj0ztF9CoTYUVuwwVTMsMf:M5dvTItFk7fiEjU6WYQultTE
Static task
static1
Behavioral task
behavioral1
Sample
132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
snakekeylogger
Protocol: ftp- Host:
ftp://bitrix370.timeweb.ru/ - Port:
21 - Username:
cn94754 - Password:
c2eitfpidhgS
Targets
-
-
Target
132eb1a40c403bc96986024b3de63dbb_JaffaCakes118
-
Size
725KB
-
MD5
132eb1a40c403bc96986024b3de63dbb
-
SHA1
52996e976b37b7ac2a53be90864b44e7d02c1974
-
SHA256
75f2d758f27b27982c84af9f9ad2677e005a72a385e48627dfa13341a4273606
-
SHA512
2757b1baba6e0d3253e7c2aca14020b739d368684f475b72ff4d470559f3626972f522ca30a7b30379d2b78df646b0f8299615758491b391b78b819be92f95e8
-
SSDEEP
12288:M9yCkuvgld21fNlRULtFkcmPMUHiMySw3Tznmj0ztF9CoTYUVuwwVTMsMf:M5dvTItFk7fiEjU6WYQultTE
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-