General
-
Target
160c1f5dd0587c3b49fb893abacf6882_JaffaCakes118
-
Size
257KB
-
Sample
240627-pwybkathnr
-
MD5
160c1f5dd0587c3b49fb893abacf6882
-
SHA1
1ccb65f16de6a144beb4abc70b4dd6f6b924fb4f
-
SHA256
a08d9bbcf25cda6dbd708cb5381df841f494f822e9ae26224212b70c0123f759
-
SHA512
586cb880d6365925984f78e90510846976befc81f3bd73c5bf1d9894b197b35846216a0540616296e2987977d09bbcc107d571005430e89fcc1eb7983b674574
-
SSDEEP
6144:RD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZDdZ:Rl8E4w5huat7UovONzbXw
Behavioral task
behavioral1
Sample
160c1f5dd0587c3b49fb893abacf6882_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
160c1f5dd0587c3b49fb893abacf6882_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
darkcomet
SummerfagFINAL2
192.162.102.160:2894
mgithens.servebeer.com:2894
fuckingwhiteknight.sytes.net:2894
DC_MUTEX-6XLBW52
-
InstallPath
MSSVC\mssvc32.exe
-
gencode
aW1mC3x94Zf8
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Ntwrksvc32
Targets
-
-
Target
160c1f5dd0587c3b49fb893abacf6882_JaffaCakes118
-
Size
257KB
-
MD5
160c1f5dd0587c3b49fb893abacf6882
-
SHA1
1ccb65f16de6a144beb4abc70b4dd6f6b924fb4f
-
SHA256
a08d9bbcf25cda6dbd708cb5381df841f494f822e9ae26224212b70c0123f759
-
SHA512
586cb880d6365925984f78e90510846976befc81f3bd73c5bf1d9894b197b35846216a0540616296e2987977d09bbcc107d571005430e89fcc1eb7983b674574
-
SSDEEP
6144:RD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZDdZ:Rl8E4w5huat7UovONzbXw
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-