General
-
Target
e5f808af24a574f4d9e12445ae50e799_JaffaCakes118
-
Size
94KB
-
Sample
240917-d3l2bssdrc
-
MD5
e5f808af24a574f4d9e12445ae50e799
-
SHA1
6d6d905a1e89cf5f674964b550e3f6512f54546b
-
SHA256
f7c3411af08ab842e09fd78c19b47bb89a3ae1ed594b730696fbb69d4c6073fd
-
SHA512
cfcec4b0a4f359be0795b5b620a7b4ca7a864dcf4e19afa315e80742ca7d898322e5ba04b0cca92e1059fb57b169e918fe26acfea987ce118d7eeae994a47017
-
SSDEEP
1536:a2M3KuJZM/sk05VYmt+8qtXWnG4dIMfZ9RNS0iGDrRdUGfrqRy/fDm:a2M6ufos5VYeqIG0/3N9iGDrRdUGfL/b
Malware Config
Targets
-
-
Target
e5f808af24a574f4d9e12445ae50e799_JaffaCakes118
-
Size
94KB
-
MD5
e5f808af24a574f4d9e12445ae50e799
-
SHA1
6d6d905a1e89cf5f674964b550e3f6512f54546b
-
SHA256
f7c3411af08ab842e09fd78c19b47bb89a3ae1ed594b730696fbb69d4c6073fd
-
SHA512
cfcec4b0a4f359be0795b5b620a7b4ca7a864dcf4e19afa315e80742ca7d898322e5ba04b0cca92e1059fb57b169e918fe26acfea987ce118d7eeae994a47017
-
SSDEEP
1536:a2M3KuJZM/sk05VYmt+8qtXWnG4dIMfZ9RNS0iGDrRdUGfrqRy/fDm:a2M6ufos5VYeqIG0/3N9iGDrRdUGfL/b
Score10/10-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-