General
-
Target
74fa777bf290823b7ab57277c441bac2_JaffaCakes118
-
Size
188KB
-
Sample
240726-vschkssarn
-
MD5
74fa777bf290823b7ab57277c441bac2
-
SHA1
2328df7f0d838191fe630cdfe8d866b91cc2f84d
-
SHA256
81b5773dfed119dfc8f49d9e4d68366918e16c2ba82d16b228774f86c4306c4a
-
SHA512
baa1d67c9fd86a05dbdf732b9d5a38d300c7c6910c9e486570b13b601b266ea34b06ce88b7348433df99225f2518021c8129b9f4ae6d19b4702b7edc2034a448
-
SSDEEP
3072:YRMv1skFQrYWii3xVrNYzdiVPbXLKFdOnofH30TL:YOv6kFQrocfrNqSzXSdOovQ
Static task
static1
Behavioral task
behavioral1
Sample
74fa777bf290823b7ab57277c441bac2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
74fa777bf290823b7ab57277c441bac2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://classicmodels.at:8080/forum/viewtopic.php
http://diva-code.at:8080/forum/viewtopic.php
-
payload_url
http://phsycopad.padmanaba.or.id/HqsMXtZz.exe
http://krivic.com/5tZ5U.exe
http://alwaysbuyincolorado.com/YcESqPEg.exe
Targets
-
-
Target
74fa777bf290823b7ab57277c441bac2_JaffaCakes118
-
Size
188KB
-
MD5
74fa777bf290823b7ab57277c441bac2
-
SHA1
2328df7f0d838191fe630cdfe8d866b91cc2f84d
-
SHA256
81b5773dfed119dfc8f49d9e4d68366918e16c2ba82d16b228774f86c4306c4a
-
SHA512
baa1d67c9fd86a05dbdf732b9d5a38d300c7c6910c9e486570b13b601b266ea34b06ce88b7348433df99225f2518021c8129b9f4ae6d19b4702b7edc2034a448
-
SSDEEP
3072:YRMv1skFQrYWii3xVrNYzdiVPbXLKFdOnofH30TL:YOv6kFQrocfrNqSzXSdOovQ
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-