General

  • Target

    fed14f26b55e5c6399efb0fc60b6bb0f_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240421-jvx2hsee95

  • MD5

    fed14f26b55e5c6399efb0fc60b6bb0f

  • SHA1

    afe05bba430254a7877ff49a97f70be81c269903

  • SHA256

    0d358e32b5d5179b47024e12845ac294c52c50a4a5a5e70f345f9bcc4b1f8328

  • SHA512

    deba5719ae4736cd429de513c9345a81ad3f6e2c9937fbd3f683c1804424be9a5ffc6fff4376f9de93dd6775c5c212b8cfbd58d96866bbcf01123df71b987371

  • SSDEEP

    49152:j/UXkHDGGGTPKHvW9s4g3WPHulePC6gahp0JNa:j/bSDPKPW9pg3AOlePC6ga/0JN

Malware Config

Targets

    • Target

      fed14f26b55e5c6399efb0fc60b6bb0f_JaffaCakes118

    • Size

      1.9MB

    • MD5

      fed14f26b55e5c6399efb0fc60b6bb0f

    • SHA1

      afe05bba430254a7877ff49a97f70be81c269903

    • SHA256

      0d358e32b5d5179b47024e12845ac294c52c50a4a5a5e70f345f9bcc4b1f8328

    • SHA512

      deba5719ae4736cd429de513c9345a81ad3f6e2c9937fbd3f683c1804424be9a5ffc6fff4376f9de93dd6775c5c212b8cfbd58d96866bbcf01123df71b987371

    • SSDEEP

      49152:j/UXkHDGGGTPKHvW9s4g3WPHulePC6gahp0JNa:j/bSDPKPW9pg3AOlePC6ga/0JN

    • Modifies security service

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Disables taskbar notifications via registry modification

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks