General

  • Target

    2c44f3573075385ec4466105542ebd8c_JaffaCakes118

  • Size

    93KB

  • Sample

    240708-n7fefszgnd

  • MD5

    2c44f3573075385ec4466105542ebd8c

  • SHA1

    0972f4ec4efbda833384c99f28748076d0ccd3ac

  • SHA256

    3929bd355f2a3080267c3325cb845689b156b912a840b4abc26af83cee1f8aff

  • SHA512

    39214b0fccab69d2c70d07c14dbc342d19eca0393bd61b535662aaaff9d0b237a356775997e50e83c1e80cc262ec2fc45b8ac39f0d6d14276dc1aed8f3a278b9

  • SSDEEP

    1536:ImPlTykJ5NTlpvjrzDxnJxAdbRMdTaH8VJ8J3v7DElnC9FkWHXp3P1:IglTykHNTPjHDxzAdlMpacH8J3aC5P

Malware Config

Targets

    • Target

      2c44f3573075385ec4466105542ebd8c_JaffaCakes118

    • Size

      93KB

    • MD5

      2c44f3573075385ec4466105542ebd8c

    • SHA1

      0972f4ec4efbda833384c99f28748076d0ccd3ac

    • SHA256

      3929bd355f2a3080267c3325cb845689b156b912a840b4abc26af83cee1f8aff

    • SHA512

      39214b0fccab69d2c70d07c14dbc342d19eca0393bd61b535662aaaff9d0b237a356775997e50e83c1e80cc262ec2fc45b8ac39f0d6d14276dc1aed8f3a278b9

    • SSDEEP

      1536:ImPlTykJ5NTlpvjrzDxnJxAdbRMdTaH8VJ8J3v7DElnC9FkWHXp3P1:IglTykHNTPjHDxzAdlMpacH8J3aC5P

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks