General
-
Target
74695f504546d7048fb3dd97e48fa2ab_JaffaCakes118
-
Size
128KB
-
Sample
240726-rmdxnswgja
-
MD5
74695f504546d7048fb3dd97e48fa2ab
-
SHA1
72a54c9a56b43b182a2198e720fe54de0298854e
-
SHA256
4e2d6f64fbee1ecdff6c4369cd4153993fa56a28e9601ea38611b72a2288e689
-
SHA512
0c9fbed0009e06664c548586e288ff968dff34c37e6655cf0178575c4a686eb61306158babf6d8b30a30bf420abef655bab57fa10c7ba3e653babf9b7fd55260
-
SSDEEP
3072:uGHi6mwXuRP5oNRw6BxqzF4tKzLoxqDHfJVPhwcj:+Qu74Rw6B3tKz0qDHffPhf
Static task
static1
Behavioral task
behavioral1
Sample
74695f504546d7048fb3dd97e48fa2ab_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
74695f504546d7048fb3dd97e48fa2ab_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://67.215.225.205:8080/forum/viewtopic.php
http://69.194.193.166/forum/viewtopic.php
-
payload_url
http://jenisegreggcouture.com/i3AnbAV.exe
http://gelerter.com/x1AZobA.exe
http://www.northeasttreeremoval.com/VDYHGMfH.exe
Targets
-
-
Target
74695f504546d7048fb3dd97e48fa2ab_JaffaCakes118
-
Size
128KB
-
MD5
74695f504546d7048fb3dd97e48fa2ab
-
SHA1
72a54c9a56b43b182a2198e720fe54de0298854e
-
SHA256
4e2d6f64fbee1ecdff6c4369cd4153993fa56a28e9601ea38611b72a2288e689
-
SHA512
0c9fbed0009e06664c548586e288ff968dff34c37e6655cf0178575c4a686eb61306158babf6d8b30a30bf420abef655bab57fa10c7ba3e653babf9b7fd55260
-
SSDEEP
3072:uGHi6mwXuRP5oNRw6BxqzF4tKzLoxqDHfJVPhwcj:+Qu74Rw6B3tKz0qDHffPhf
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-