General
-
Target
68d98b222464c208b28627041cb04062_JaffaCakes118
-
Size
114KB
-
Sample
240729-315hbs1hpa
-
MD5
68d98b222464c208b28627041cb04062
-
SHA1
a330c5e4e628a2cf329d82badc90528404a02556
-
SHA256
bb304285866d6484534485e20c9dc455843a7745d0685ee6688780c78fc56e91
-
SHA512
038c1e95bbf524b852d02a5c32bdd46db6d6c1263bb2af587a0949c06cc4c43a15c91e2e8c10b5a46ff33a0eb14054ec8abbe6be400a18c373f3f53504f05537
-
SSDEEP
3072:hRHZWQgYjUJapCJhR9EoD9wZ9QX8nhhBQuQ:bZ5g4UJCOhUoZw7QufQ
Static task
static1
Behavioral task
behavioral1
Sample
68d98b222464c208b28627041cb04062_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
pony
http://trueyogateacherblog.com/resp.php
http://thesavvyplayer.com/images/view.php
Targets
-
-
Target
68d98b222464c208b28627041cb04062_JaffaCakes118
-
Size
114KB
-
MD5
68d98b222464c208b28627041cb04062
-
SHA1
a330c5e4e628a2cf329d82badc90528404a02556
-
SHA256
bb304285866d6484534485e20c9dc455843a7745d0685ee6688780c78fc56e91
-
SHA512
038c1e95bbf524b852d02a5c32bdd46db6d6c1263bb2af587a0949c06cc4c43a15c91e2e8c10b5a46ff33a0eb14054ec8abbe6be400a18c373f3f53504f05537
-
SSDEEP
3072:hRHZWQgYjUJapCJhR9EoD9wZ9QX8nhhBQuQ:bZ5g4UJCOhUoZw7QufQ
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-