General
-
Target
73d186abe04b4e72a2644da148ad0cc5_JaffaCakes118
-
Size
145KB
-
Sample
240726-nc2n7syane
-
MD5
73d186abe04b4e72a2644da148ad0cc5
-
SHA1
870d62b2a2f11d632a104ce827feb2447c47146d
-
SHA256
8c768b5929e9d2bb0eb6963eaebc29a3824d5f02def6163b33bef49b8e9397b7
-
SHA512
37a1da4c18c0bd408c483e1157cf5b366a72bd525a46a5d926b2c7e1b5eeb4dbe7c8f16e60c6de422342e1e0a3f6c8821ac00227348365dfaf87850628e87342
-
SSDEEP
3072:J9PkfIVE4DYnKEqXxX1CVEWPa4mXhgYvcou7Ey0yn8MbgfovR9:HI4sZC1EEWPanuD0T5fovR
Static task
static1
Behavioral task
behavioral1
Sample
73d186abe04b4e72a2644da148ad0cc5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
73d186abe04b4e72a2644da148ad0cc5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://209.59.219.1/forum/viewtopic.php
http://212.58.20.11/forum/viewtopic.php
-
payload_url
http://tempo-www.asepta.com/deo.exe
http://afyonmatbaa.com/GcX.exe
Targets
-
-
Target
73d186abe04b4e72a2644da148ad0cc5_JaffaCakes118
-
Size
145KB
-
MD5
73d186abe04b4e72a2644da148ad0cc5
-
SHA1
870d62b2a2f11d632a104ce827feb2447c47146d
-
SHA256
8c768b5929e9d2bb0eb6963eaebc29a3824d5f02def6163b33bef49b8e9397b7
-
SHA512
37a1da4c18c0bd408c483e1157cf5b366a72bd525a46a5d926b2c7e1b5eeb4dbe7c8f16e60c6de422342e1e0a3f6c8821ac00227348365dfaf87850628e87342
-
SSDEEP
3072:J9PkfIVE4DYnKEqXxX1CVEWPa4mXhgYvcou7Ey0yn8MbgfovR9:HI4sZC1EEWPanuD0T5fovR
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-