General
-
Target
172c6f84da60d0c4f47eeb4ce0f5a030_JaffaCakes118
-
Size
133KB
-
Sample
240728-ts2xsssbrr
-
MD5
172c6f84da60d0c4f47eeb4ce0f5a030
-
SHA1
99117a47d283f14c0b8ffe5716438f2302a45302
-
SHA256
d8bc212c81693878be4c911a68438301ea442fa434a4787460369a9be699a1f0
-
SHA512
74ea197d6dcdc80176109ab3bd4dc51f05c9489c466ec0ea1636a5070815d5f49d6474bfb5dc6ec31e004d4848aedeff120f762efe6e890c47363771f138c45c
-
SSDEEP
1536:LeLpbwbSCmHLv6PiIu42g226utMTF9r8k7Cm3/GUoCpLefy3D1WlnlwzPav5S:SL8o2KI7quOqv8oCVe6QwWv5S
Static task
static1
Behavioral task
behavioral1
Sample
172c6f84da60d0c4f47eeb4ce0f5a030_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
172c6f84da60d0c4f47eeb4ce0f5a030_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://168.144.38.105:8080/forum/viewtopic.php
http://capitulosde.com:8080/forum/viewtopic.php
-
payload_url
http://tgo-proyectos.com/vAmfp.exe
http://aktibbicihazlar.com/avmjH6g.exe
http://origin.ind.in/Ln0HQw.exe
Targets
-
-
Target
172c6f84da60d0c4f47eeb4ce0f5a030_JaffaCakes118
-
Size
133KB
-
MD5
172c6f84da60d0c4f47eeb4ce0f5a030
-
SHA1
99117a47d283f14c0b8ffe5716438f2302a45302
-
SHA256
d8bc212c81693878be4c911a68438301ea442fa434a4787460369a9be699a1f0
-
SHA512
74ea197d6dcdc80176109ab3bd4dc51f05c9489c466ec0ea1636a5070815d5f49d6474bfb5dc6ec31e004d4848aedeff120f762efe6e890c47363771f138c45c
-
SSDEEP
1536:LeLpbwbSCmHLv6PiIu42g226utMTF9r8k7Cm3/GUoCpLefy3D1WlnlwzPav5S:SL8o2KI7quOqv8oCVe6QwWv5S
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-