General
-
Target
665a2160ac3de2fc83412a788f6055ed_JaffaCakes118
-
Size
90KB
-
Sample
240729-25zxzazdlh
-
MD5
665a2160ac3de2fc83412a788f6055ed
-
SHA1
ddbc1f8a6b57141b3bc33cc31f3ab04a320e6d12
-
SHA256
a6db28c525f34ab34ef8eb02c2edb12899a7e5ff6db40c79407563811216ae87
-
SHA512
e328669a38b7d83dcc47a25abfcf49083b1d86808b5d8f0bb80aa3728cb0c151265a917e6ff78c5f3b7be1ea869ea58f18c51ada018d62fb80459796c36a6720
-
SSDEEP
1536:1eCZ1HGGTqTQHDPOQtP/2XipupOpqaZf0S0HAcAOkACPZTvoEAxkzmFS:MCZ4GfOQtP/2XNpOs+djOS2EAtFS
Behavioral task
behavioral1
Sample
665a2160ac3de2fc83412a788f6055ed_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
665a2160ac3de2fc83412a788f6055ed_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://login1.ministryofvapes.com/Panel/gate.php
-
payload_url
http://login1.ministryofvapes.com/Panel/Pony.exe
Targets
-
-
Target
665a2160ac3de2fc83412a788f6055ed_JaffaCakes118
-
Size
90KB
-
MD5
665a2160ac3de2fc83412a788f6055ed
-
SHA1
ddbc1f8a6b57141b3bc33cc31f3ab04a320e6d12
-
SHA256
a6db28c525f34ab34ef8eb02c2edb12899a7e5ff6db40c79407563811216ae87
-
SHA512
e328669a38b7d83dcc47a25abfcf49083b1d86808b5d8f0bb80aa3728cb0c151265a917e6ff78c5f3b7be1ea869ea58f18c51ada018d62fb80459796c36a6720
-
SSDEEP
1536:1eCZ1HGGTqTQHDPOQtP/2XipupOpqaZf0S0HAcAOkACPZTvoEAxkzmFS:MCZ4GfOQtP/2XNpOs+djOS2EAtFS
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-