General
-
Target
7398f4fc65eaaa5cc3a64c585097c6e2_JaffaCakes118
-
Size
144KB
-
Sample
240726-l6d4wsvaqh
-
MD5
7398f4fc65eaaa5cc3a64c585097c6e2
-
SHA1
c146f69ce22ff4fe86e15a2b9daa18c75e8ae285
-
SHA256
9c2a8d4e0cbc0c146169146547cda0fa9f7361d500344f24d68f509824082b19
-
SHA512
d9c72ef6e9190eb2c2e2eac8a07bef806b10d30f0f9787c66a2b1ccaf679404df0e8c8479830f39849d5bc74fbe4687b4d40ad119c97c8b0b0fa14f5029d0adc
-
SSDEEP
3072:s0IYwk7xA1AxD4HMZMa8oiLrejrUboD9t0mUpaJ8DwMffA:nIYwkdV4HSMaViqIb0tea4wYfA
Static task
static1
Behavioral task
behavioral1
Sample
7398f4fc65eaaa5cc3a64c585097c6e2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7398f4fc65eaaa5cc3a64c585097c6e2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://74.53.97.66:8080/forum/viewtopic.php
http://74.53.97.67:8080/forum/viewtopic.php
-
payload_url
http://termassistant.com/6mx9VVCJ.exe
http://elektrabukacek.cz/hs9HBpbT.exe
Targets
-
-
Target
7398f4fc65eaaa5cc3a64c585097c6e2_JaffaCakes118
-
Size
144KB
-
MD5
7398f4fc65eaaa5cc3a64c585097c6e2
-
SHA1
c146f69ce22ff4fe86e15a2b9daa18c75e8ae285
-
SHA256
9c2a8d4e0cbc0c146169146547cda0fa9f7361d500344f24d68f509824082b19
-
SHA512
d9c72ef6e9190eb2c2e2eac8a07bef806b10d30f0f9787c66a2b1ccaf679404df0e8c8479830f39849d5bc74fbe4687b4d40ad119c97c8b0b0fa14f5029d0adc
-
SSDEEP
3072:s0IYwk7xA1AxD4HMZMa8oiLrejrUboD9t0mUpaJ8DwMffA:nIYwkdV4HSMaViqIb0tea4wYfA
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-