General
-
Target
50d25f4d1df9b29cdb291b65062efbce_JaffaCakes118
-
Size
90KB
-
Sample
240517-wv39racc76
-
MD5
50d25f4d1df9b29cdb291b65062efbce
-
SHA1
3065dff3b87f66297d1e4e7b1ede3e311d9b70e5
-
SHA256
cccec26f1a45d64338ec56624b29d13e72736e5795412975da4c279b663763eb
-
SHA512
fd5d402d5563b7b0a5da60d902c4d0af50fb2b91f43af2cfeb631e27b8f734eae6ccef5d7f3d4e44283c92ad241c71df932141f6d59772ee4126ad5d9bffbf36
-
SSDEEP
1536:inCDLwy6qTW/vUb+GiBO/WXaJkUgdJ4EiONdR85TvoEAYkzmdx:MCDjuUSBBO/me7ayO3EAkdx
Behavioral task
behavioral1
Sample
50d25f4d1df9b29cdb291b65062efbce_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
pony
http://cb94336.tmweb.ru/moneylong/benzes/gate.php
-
payload_url
http://cq78109.tmweb.ru/newmoneyy/arabmoney/micro.exe
Targets
-
-
Target
50d25f4d1df9b29cdb291b65062efbce_JaffaCakes118
-
Size
90KB
-
MD5
50d25f4d1df9b29cdb291b65062efbce
-
SHA1
3065dff3b87f66297d1e4e7b1ede3e311d9b70e5
-
SHA256
cccec26f1a45d64338ec56624b29d13e72736e5795412975da4c279b663763eb
-
SHA512
fd5d402d5563b7b0a5da60d902c4d0af50fb2b91f43af2cfeb631e27b8f734eae6ccef5d7f3d4e44283c92ad241c71df932141f6d59772ee4126ad5d9bffbf36
-
SSDEEP
1536:inCDLwy6qTW/vUb+GiBO/WXaJkUgdJ4EiONdR85TvoEAYkzmdx:MCDjuUSBBO/me7ayO3EAkdx
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-