General
-
Target
1b4d0e1be914d26e77d18b27b397619f_JaffaCakes118
-
Size
7.5MB
-
Sample
240701-pm6xca1gpb
-
MD5
1b4d0e1be914d26e77d18b27b397619f
-
SHA1
da852bd63955866164182a2eeada13b76f1a3128
-
SHA256
611b32860e4937210465e96f7137c6888c7de154f4574f2a6c07885b75818363
-
SHA512
381835ad8a3959a6580a6094c113677ca4e99f682508d91161445e656370de3cb189e5630b6c48f6c24b307feb375716c838882add6afed92112d88320961405
-
SSDEEP
196608:ZXx7KRoJGICteEroXxWVfEqlbkkwR7VTEHZFLgVSVegoQZ:HwSGInEroXgfEqirRRoHZBgVSHN
Behavioral task
behavioral1
Sample
1b4d0e1be914d26e77d18b27b397619f_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Targets
-
-
Target
1b4d0e1be914d26e77d18b27b397619f_JaffaCakes118
-
Size
7.5MB
-
MD5
1b4d0e1be914d26e77d18b27b397619f
-
SHA1
da852bd63955866164182a2eeada13b76f1a3128
-
SHA256
611b32860e4937210465e96f7137c6888c7de154f4574f2a6c07885b75818363
-
SHA512
381835ad8a3959a6580a6094c113677ca4e99f682508d91161445e656370de3cb189e5630b6c48f6c24b307feb375716c838882add6afed92112d88320961405
-
SSDEEP
196608:ZXx7KRoJGICteEroXxWVfEqlbkkwR7VTEHZFLgVSVegoQZ:HwSGInEroXgfEqirRRoHZBgVSHN
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-