General
-
Target
17aa3ab06df05f25d63be19012c412a2_JaffaCakes118
-
Size
113KB
-
Sample
240627-1r4hkashke
-
MD5
17aa3ab06df05f25d63be19012c412a2
-
SHA1
1ed7f786c82363570a56b11e0cc358a9c615064e
-
SHA256
6556238146126cb546f0f9ff33a15bc1759bbeb7742ca0c72074a308cee55845
-
SHA512
0ca077cb3ca4553ae3064a0694fc24f3ef5b1b7b57708cb5ac2b4323f65a83e9cf636211dee396dc32f4568f6f12115b01caec0bd09e5d35b172fc31e7d6748a
-
SSDEEP
3072:kTY7VKne2w1GBcMc0ToVA+6moAiKkj2Xa7Ur:sgVH2wcjc00B4yV
Static task
static1
Behavioral task
behavioral1
Sample
17aa3ab06df05f25d63be19012c412a2_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
pony
http://sam-latrilogie.com:8080/pony/gate.php
http://loceanic.fr:8080/pony/gate.php
-
payload_url
http://www.uniaotec.com.br/0Yoo6.exe
http://216.119.80.138/KY5.exe
http://ftp.videoheretic.com/vFs6cZZ.exe
Targets
-
-
Target
17aa3ab06df05f25d63be19012c412a2_JaffaCakes118
-
Size
113KB
-
MD5
17aa3ab06df05f25d63be19012c412a2
-
SHA1
1ed7f786c82363570a56b11e0cc358a9c615064e
-
SHA256
6556238146126cb546f0f9ff33a15bc1759bbeb7742ca0c72074a308cee55845
-
SHA512
0ca077cb3ca4553ae3064a0694fc24f3ef5b1b7b57708cb5ac2b4323f65a83e9cf636211dee396dc32f4568f6f12115b01caec0bd09e5d35b172fc31e7d6748a
-
SSDEEP
3072:kTY7VKne2w1GBcMc0ToVA+6moAiKkj2Xa7Ur:sgVH2wcjc00B4yV
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-