General
-
Target
7357c3262efcc760f23e61c58809552b_JaffaCakes118
-
Size
157KB
-
Sample
240726-kmze2sxdpp
-
MD5
7357c3262efcc760f23e61c58809552b
-
SHA1
493455e1ea9477d32b90c4360473832d4f5daf4d
-
SHA256
d024f0bd32e1211baab9512fefe97a776424afcac71dbc25fcdc38e07836e8cd
-
SHA512
da13345726a61d3bca8ad5020f3b86d38dc4a37ad8120e6f011a40f9e22868d6afbea3c164cfc9d7b9127ae771585049dfd6afb34d5e79b8af10fb37cdc8c4d0
-
SSDEEP
3072:KmJ9OQoTNF3M6C53V4LOEEHggJMdDkhpwX4qOHy:KmJRoTNFc53V4LAAgEywXn2
Static task
static1
Behavioral task
behavioral1
Sample
7357c3262efcc760f23e61c58809552b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7357c3262efcc760f23e61c58809552b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://67.215.225.205:8080/forum/viewtopic.php
http://69.194.193.166/forum/viewtopic.php
-
payload_url
http://acwebnet.com/cueT50r.exe
http://grandfoolsderby.com/k3Jz2.exe
http://www.fahrsicherheit-cardrive.de/ZGg.exe
Targets
-
-
Target
7357c3262efcc760f23e61c58809552b_JaffaCakes118
-
Size
157KB
-
MD5
7357c3262efcc760f23e61c58809552b
-
SHA1
493455e1ea9477d32b90c4360473832d4f5daf4d
-
SHA256
d024f0bd32e1211baab9512fefe97a776424afcac71dbc25fcdc38e07836e8cd
-
SHA512
da13345726a61d3bca8ad5020f3b86d38dc4a37ad8120e6f011a40f9e22868d6afbea3c164cfc9d7b9127ae771585049dfd6afb34d5e79b8af10fb37cdc8c4d0
-
SSDEEP
3072:KmJ9OQoTNF3M6C53V4LOEEHggJMdDkhpwX4qOHy:KmJRoTNFc53V4LAAgEywXn2
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-