General
-
Target
7549799bedcf643062819dfd37165245_JaffaCakes118
-
Size
172KB
-
Sample
240726-xh78lsxglp
-
MD5
7549799bedcf643062819dfd37165245
-
SHA1
53841b075485a490930803708026d64d8b3d4c65
-
SHA256
79575fa7109f59998b503959160495c63f605f8e0f7f42d66606ab7d221cb19b
-
SHA512
aa898406ce3e2b7f106e4a021cf5522b9762550213a3f66bf4c98d51a65d16ced5c084d4cd55dee7ffebd712046811388985cc7bd93cca846dc7386877b45352
-
SSDEEP
3072:QpXwa2bG7/Tg2DmffDrbYHHf3xaW3whYtNYKMej:/zSTTLmfbHe/haMwNKZ
Static task
static1
Behavioral task
behavioral1
Sample
7549799bedcf643062819dfd37165245_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7549799bedcf643062819dfd37165245_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://108.166.65.182:8080/pony/gate.php
http://66.85.144.243/pony/gate.php
-
payload_url
http://bgdt.co.uk/2A3.exe
http://madeiras10.com.br/ZNg8uR.exe
http://aencuentro.com.ar/xc25nXp.exe
Targets
-
-
Target
7549799bedcf643062819dfd37165245_JaffaCakes118
-
Size
172KB
-
MD5
7549799bedcf643062819dfd37165245
-
SHA1
53841b075485a490930803708026d64d8b3d4c65
-
SHA256
79575fa7109f59998b503959160495c63f605f8e0f7f42d66606ab7d221cb19b
-
SHA512
aa898406ce3e2b7f106e4a021cf5522b9762550213a3f66bf4c98d51a65d16ced5c084d4cd55dee7ffebd712046811388985cc7bd93cca846dc7386877b45352
-
SSDEEP
3072:QpXwa2bG7/Tg2DmffDrbYHHf3xaW3whYtNYKMej:/zSTTLmfbHe/haMwNKZ
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-