General
-
Target
d75ca46752544fa41adfff58728312f6_JaffaCakes118
-
Size
128KB
-
Sample
240910-a7ek9szhqf
-
MD5
d75ca46752544fa41adfff58728312f6
-
SHA1
a986f0a75fd6379297455c6819c585194903385a
-
SHA256
760b43ad407594a4addce8e3e20d90d739666e91f7dbea394f6eda6d9c9a0d40
-
SHA512
57716344a11e80eb24ba57b53e9c57b8c9223bc19d71a8f0a82a0f432392b07830bac414279b1a6d47ee0803e1cb85de915778f8788b6e45a567bf136b7bd319
-
SSDEEP
3072:uGHi6mw6NFC+Nzs57Y7cZTwqh4xEiUoF4TDwUr58ngej6:+tNLzs57Y7c1TiDUdTDun7
Static task
static1
Behavioral task
behavioral1
Sample
d75ca46752544fa41adfff58728312f6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d75ca46752544fa41adfff58728312f6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
pony
http://67.215.225.205:8080/forum/viewtopic.php
http://216.231.139.111/forum/viewtopic.php
-
payload_url
http://www.chandlerbacker.com/J9K.exe
http://bobinlaminasyonmakinalari.com/o9RYHbCx.exe
http://broadbentcompany.wsisrdev.com/KbGb.exe
Targets
-
-
Target
d75ca46752544fa41adfff58728312f6_JaffaCakes118
-
Size
128KB
-
MD5
d75ca46752544fa41adfff58728312f6
-
SHA1
a986f0a75fd6379297455c6819c585194903385a
-
SHA256
760b43ad407594a4addce8e3e20d90d739666e91f7dbea394f6eda6d9c9a0d40
-
SHA512
57716344a11e80eb24ba57b53e9c57b8c9223bc19d71a8f0a82a0f432392b07830bac414279b1a6d47ee0803e1cb85de915778f8788b6e45a567bf136b7bd319
-
SSDEEP
3072:uGHi6mw6NFC+Nzs57Y7cZTwqh4xEiUoF4TDwUr58ngej6:+tNLzs57Y7c1TiDUdTDun7
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-