General
-
Target
1de373b11595fabb241db93b799b978a_JaffaCakes118
-
Size
505KB
-
Sample
240702-ebv1latgph
-
MD5
1de373b11595fabb241db93b799b978a
-
SHA1
b3921a1ec91acfc4e414f1748a219d97d9400244
-
SHA256
20d6b633c956d62b403d5606d19087c849a389e418a4f584aecc7e482ce85d72
-
SHA512
937d3d2c6e8c455822c8d2aea9a5d913dfccbb9bd7b55a0f2d8d3b66a34c1a88fdb70841806098f09cfc2b0ac23ac5bf730955fc69f97cb9d47a17195f5442ed
-
SSDEEP
12288:ZK3D4laLHWhujOl4EsJj0TN09tnXxsQtOKL1o0v0txUnh5csx6m:QVLHGujOS90TNwhseOAX4hsxF
Static task
static1
Behavioral task
behavioral1
Sample
1de373b11595fabb241db93b799b978a_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1de373b11595fabb241db93b799b978a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
darkcomet
servermain
xgreenstonex.no-ip.biz:1604
DC_MUTEX-4K7GGLT
-
gencode
379wZYAo9xu2
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
1de373b11595fabb241db93b799b978a_JaffaCakes118
-
Size
505KB
-
MD5
1de373b11595fabb241db93b799b978a
-
SHA1
b3921a1ec91acfc4e414f1748a219d97d9400244
-
SHA256
20d6b633c956d62b403d5606d19087c849a389e418a4f584aecc7e482ce85d72
-
SHA512
937d3d2c6e8c455822c8d2aea9a5d913dfccbb9bd7b55a0f2d8d3b66a34c1a88fdb70841806098f09cfc2b0ac23ac5bf730955fc69f97cb9d47a17195f5442ed
-
SSDEEP
12288:ZK3D4laLHWhujOl4EsJj0TN09tnXxsQtOKL1o0v0txUnh5csx6m:QVLHGujOS90TNwhseOAX4hsxF
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-