General
-
Target
6b21a2737d56f36a02964f983ef9c897_JaffaCakes118
-
Size
208KB
-
Sample
240523-q2aywsdd27
-
MD5
6b21a2737d56f36a02964f983ef9c897
-
SHA1
0cbeb86877656c664626b5e29eb74c80fa7c9286
-
SHA256
9191043cb1f8a78861992ca40065c000960852b9e9c02a94f95747202405feb0
-
SHA512
1d3e652d89e4f409f7ee2c33cd4c6710d3da37ddb93d9c1a336c04a4087ffbbacb78e50f395f4f3c9c88709be2c544c95918518116367b087e5339670066a603
-
SSDEEP
3072:oV+14M3PnG8+OIhbqrWg3ISKbkokgjAtPg6L9:oV+v/UOIIq4IzOZ
Behavioral task
behavioral1
Sample
6b21a2737d56f36a02964f983ef9c897_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
pony
http://jaysman.darkbastard.com.de/panel/gate.php
Targets
-
-
Target
6b21a2737d56f36a02964f983ef9c897_JaffaCakes118
-
Size
208KB
-
MD5
6b21a2737d56f36a02964f983ef9c897
-
SHA1
0cbeb86877656c664626b5e29eb74c80fa7c9286
-
SHA256
9191043cb1f8a78861992ca40065c000960852b9e9c02a94f95747202405feb0
-
SHA512
1d3e652d89e4f409f7ee2c33cd4c6710d3da37ddb93d9c1a336c04a4087ffbbacb78e50f395f4f3c9c88709be2c544c95918518116367b087e5339670066a603
-
SSDEEP
3072:oV+14M3PnG8+OIhbqrWg3ISKbkokgjAtPg6L9:oV+v/UOIIq4IzOZ
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-