General
-
Target
5e7e69dbee9db433230ecef62f6f4b1d_JaffaCakes118
-
Size
114KB
-
Sample
240729-zczematdnf
-
MD5
5e7e69dbee9db433230ecef62f6f4b1d
-
SHA1
c1528f5eec00f3eca526bce270a9a2a2b70d7a06
-
SHA256
281ea251cfabf55a4cb596618a3d32dfd1af48785a3477847c40097f7143b6eb
-
SHA512
4b62cc53215fafde803a244cd87daaa8503b19541f3843c98c8b103433ca6c3d261d6e40d2c9e6b89b7c401dbc3c586dd1ae55cd97b3ad855eaab7b84827ae5a
-
SSDEEP
3072:/XAtWYKBlVkrGjYBIzIUISwI9f6moRbq0MX9iJyOl9:fAoYKXVksmIzequlMX9iJy
Static task
static1
Behavioral task
behavioral1
Sample
5e7e69dbee9db433230ecef62f6f4b1d_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
5e7e69dbee9db433230ecef62f6f4b1d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Malware Config
Extracted
pony
http://209.59.216.75/pony/gate.php
http://66.175.212.25/pony/gate.php
-
payload_url
http://nuflush.com/gtquEkD.exe
Targets
-
-
Target
5e7e69dbee9db433230ecef62f6f4b1d_JaffaCakes118
-
Size
114KB
-
MD5
5e7e69dbee9db433230ecef62f6f4b1d
-
SHA1
c1528f5eec00f3eca526bce270a9a2a2b70d7a06
-
SHA256
281ea251cfabf55a4cb596618a3d32dfd1af48785a3477847c40097f7143b6eb
-
SHA512
4b62cc53215fafde803a244cd87daaa8503b19541f3843c98c8b103433ca6c3d261d6e40d2c9e6b89b7c401dbc3c586dd1ae55cd97b3ad855eaab7b84827ae5a
-
SSDEEP
3072:/XAtWYKBlVkrGjYBIzIUISwI9f6moRbq0MX9iJyOl9:fAoYKXVksmIzequlMX9iJy
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-