General
-
Target
dd6883a7eda2fcb2433e23f4ad8b1fd4_JaffaCakes118
-
Size
93KB
-
Sample
240913-bvjvwsxckh
-
MD5
dd6883a7eda2fcb2433e23f4ad8b1fd4
-
SHA1
ce4e8a2d02c348b92d3f5937b3e08a7bbc5f3d82
-
SHA256
c1e78caad66e7da85c31af641dc74ab9740dd70824610de5975c66635070cffb
-
SHA512
e6dfa649d2e0dc790ebac6461846e26cdb424b9c4229b1fb52011faadc7bb9bbaca70f53dcf58ce8c48c2da9beea3930d11641bcf7bc21edeb2c475db11a2039
-
SSDEEP
1536:3JnafHYuEN/LO51J9O2+tB9dqS+aoSfDsHT8ODI+SuskI9qkEJjxc5Y+NfO9eAf2:3JafaNzO51JM2w9+aodHTlqmSqP90lk2
Malware Config
Targets
-
-
Target
dd6883a7eda2fcb2433e23f4ad8b1fd4_JaffaCakes118
-
Size
93KB
-
MD5
dd6883a7eda2fcb2433e23f4ad8b1fd4
-
SHA1
ce4e8a2d02c348b92d3f5937b3e08a7bbc5f3d82
-
SHA256
c1e78caad66e7da85c31af641dc74ab9740dd70824610de5975c66635070cffb
-
SHA512
e6dfa649d2e0dc790ebac6461846e26cdb424b9c4229b1fb52011faadc7bb9bbaca70f53dcf58ce8c48c2da9beea3930d11641bcf7bc21edeb2c475db11a2039
-
SSDEEP
1536:3JnafHYuEN/LO51J9O2+tB9dqS+aoSfDsHT8ODI+SuskI9qkEJjxc5Y+NfO9eAf2:3JafaNzO51JM2w9+aodHTlqmSqP90lk2
Score10/10-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-