General
-
Target
5b6a8d48053a109f734a3f76538576f1_JaffaCakes118
-
Size
559KB
-
Sample
240729-x84ywa1dmb
-
MD5
5b6a8d48053a109f734a3f76538576f1
-
SHA1
eb753137975f03a8d5b8e333319d97bc6331879c
-
SHA256
1f5727f2bb376c12395e954d8e0bddff7223f0e9349b49136eb9ed8a583c773b
-
SHA512
d7b4c114d469aa5ecf746cbdfdc513db709570bfef38ff647d325d7465978e87afb9c8fe13659225addaad9f2001303af1b26622186545a164c9815814ba4138
-
SSDEEP
12288:5uTOWwLsyfJ1Zesrk0qb641BS35AAX6aLlm9f+QxFBbv:FNHLo6GS351lmN+e
Behavioral task
behavioral1
Sample
5b6a8d48053a109f734a3f76538576f1_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
5b6a8d48053a109f734a3f76538576f1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://top-glenyx.com/ppnngrr/gate.php
http://marinzer-3.com/ppnngrr/gate.php
http://amerillia.net/ppnngrr/gate.php
http://matterix-net.net/ppnngrr/gate.php
Targets
-
-
Target
5b6a8d48053a109f734a3f76538576f1_JaffaCakes118
-
Size
559KB
-
MD5
5b6a8d48053a109f734a3f76538576f1
-
SHA1
eb753137975f03a8d5b8e333319d97bc6331879c
-
SHA256
1f5727f2bb376c12395e954d8e0bddff7223f0e9349b49136eb9ed8a583c773b
-
SHA512
d7b4c114d469aa5ecf746cbdfdc513db709570bfef38ff647d325d7465978e87afb9c8fe13659225addaad9f2001303af1b26622186545a164c9815814ba4138
-
SSDEEP
12288:5uTOWwLsyfJ1Zesrk0qb641BS35AAX6aLlm9f+QxFBbv:FNHLo6GS351lmN+e
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-