General
-
Target
6abb9f54ac7fe34c178d3db652ca48db_JaffaCakes118
-
Size
114KB
-
Sample
240730-axpcqatbmg
-
MD5
6abb9f54ac7fe34c178d3db652ca48db
-
SHA1
81e18a311112fd20935c163d80db661187c0b4b6
-
SHA256
2fe039ade455c1d2f1263b4ba5004b2b9c356d9850e14ce0c60b75adab5b0b8a
-
SHA512
6c5edb81a6102782aa7813beed5e71f6b0a54ae49fa675da21d03aea8c49ba799ec320a7164f9cdfdfd09023b95714f2c9ebf6462df3ee7bad0736ad3cda9c38
-
SSDEEP
3072:/XAtWYKBlVwaGCNDpILTKAO6moNOyDN3UYz9:fAoYKXVwAJpIk4h
Static task
static1
Behavioral task
behavioral1
Sample
6abb9f54ac7fe34c178d3db652ca48db_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6abb9f54ac7fe34c178d3db652ca48db_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
pony
http://etsiunjour.fr:81/pony/gate.php
http://209.59.217.36/pony/gate.php
-
payload_url
http://ftp.ex-fin.sk/0rk5TF.exe
http://archstone.ro/yuzFyjAw.exe
Targets
-
-
Target
6abb9f54ac7fe34c178d3db652ca48db_JaffaCakes118
-
Size
114KB
-
MD5
6abb9f54ac7fe34c178d3db652ca48db
-
SHA1
81e18a311112fd20935c163d80db661187c0b4b6
-
SHA256
2fe039ade455c1d2f1263b4ba5004b2b9c356d9850e14ce0c60b75adab5b0b8a
-
SHA512
6c5edb81a6102782aa7813beed5e71f6b0a54ae49fa675da21d03aea8c49ba799ec320a7164f9cdfdfd09023b95714f2c9ebf6462df3ee7bad0736ad3cda9c38
-
SSDEEP
3072:/XAtWYKBlVwaGCNDpILTKAO6moNOyDN3UYz9:fAoYKXVwAJpIk4h
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-