General
-
Target
79ad188aa4c9878f6772aebb988c68b9_JaffaCakes118
-
Size
34KB
-
Sample
240527-xenpssdg5v
-
MD5
79ad188aa4c9878f6772aebb988c68b9
-
SHA1
0bc7049e7b52d23dafd2e8a4ec009c21cc7da478
-
SHA256
1cf91e4d5761f91f37113629abec72c88f226da028f017feb46cc42b765b0b64
-
SHA512
cc90e19f8c488104ee788036e149c62f07e708b2b1c6267b5e45bc17c67a359319ebc413531f04a2750581fe9583a76e4ff52b3da1f8ab423201848e90baee8a
-
SSDEEP
768:1MZGM4+DmnMiczHX7VXgex6Ew4JJ8hH6wDQd68in0d:CZA+as37VwQJJEJQdzd
Behavioral task
behavioral1
Sample
79ad188aa4c9878f6772aebb988c68b9_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
out.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
pony
http://hivamusic.ir/db/p/gate.php
-
payload_url
http://hivamusic.ir/db/p/micro.exe
Targets
-
-
Target
79ad188aa4c9878f6772aebb988c68b9_JaffaCakes118
-
Size
34KB
-
MD5
79ad188aa4c9878f6772aebb988c68b9
-
SHA1
0bc7049e7b52d23dafd2e8a4ec009c21cc7da478
-
SHA256
1cf91e4d5761f91f37113629abec72c88f226da028f017feb46cc42b765b0b64
-
SHA512
cc90e19f8c488104ee788036e149c62f07e708b2b1c6267b5e45bc17c67a359319ebc413531f04a2750581fe9583a76e4ff52b3da1f8ab423201848e90baee8a
-
SSDEEP
768:1MZGM4+DmnMiczHX7VXgex6Ew4JJ8hH6wDQd68in0d:CZA+as37VwQJJEJQdzd
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
out.upx
-
Size
90KB
-
MD5
165c36222aa29e15b9c76a0d5afd21f0
-
SHA1
084c48de336b666d5e1b0ba76ff320c6d1440752
-
SHA256
2561aa28234cf72c4813cf55480aef6c548874c2a534c3bc69940c3cb00badb4
-
SHA512
50562b53391230371ef37731af567df143165a7071c7c213e8084180a0468f22ba729ae5a040d349bcff6c34a9725cb36804381f7da397962cbf6680f2f6da5a
-
SSDEEP
1536:ot+iWUUqTTDyog75NuxQ4nMR5P7Zz0PWjq/POIZxjTvSc9JEQDkzm:u4etI2xQ4MbxgOrcHEQb
Score3/10 -