General
-
Target
16a850e7a3ccee8b6a406f92ec927553_JaffaCakes118
-
Size
143KB
-
Sample
240627-tp4bfsyhph
-
MD5
16a850e7a3ccee8b6a406f92ec927553
-
SHA1
52e651642ae78f24e52aeba5a15c61b2e64e4d3a
-
SHA256
123859c8f826c327c60e64f5fea1519172027bf1d5807063ccfd9da77d161c19
-
SHA512
78efd7ba6fd47a447e84c8599f1c37ef756b84c91cb608ed1c7454a31e301fec4b67c718df8d223393a4610c05be108a34026296ff376def276692ba038ba80c
-
SSDEEP
3072:0e6EY/P5PLolMa9UL+C4wj9rIL74HExp8VBi:oR/JJa9UYmExIU
Static task
static1
Behavioral task
behavioral1
Sample
16a850e7a3ccee8b6a406f92ec927553_JaffaCakes118.exe
Resource
win7-20240220-en
Malware Config
Extracted
pony
http://64.111.24.123/pony/gate.php
http://66.175.216.111/pony/gate.php
-
payload_url
http://www.healthcarereach.com/S6W9.exe
http://portaldomarmoreegranito.com.br/mxqPz.exe
http://dedetizadoraalexandrelopes.com.br/7aen.exe
Targets
-
-
Target
16a850e7a3ccee8b6a406f92ec927553_JaffaCakes118
-
Size
143KB
-
MD5
16a850e7a3ccee8b6a406f92ec927553
-
SHA1
52e651642ae78f24e52aeba5a15c61b2e64e4d3a
-
SHA256
123859c8f826c327c60e64f5fea1519172027bf1d5807063ccfd9da77d161c19
-
SHA512
78efd7ba6fd47a447e84c8599f1c37ef756b84c91cb608ed1c7454a31e301fec4b67c718df8d223393a4610c05be108a34026296ff376def276692ba038ba80c
-
SSDEEP
3072:0e6EY/P5PLolMa9UL+C4wj9rIL74HExp8VBi:oR/JJa9UYmExIU
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-