General
-
Target
f1e8ed93af37fe3f88153a92d7784ba8_JaffaCakes118
-
Size
280KB
-
Sample
240922-nc1rxawhpq
-
MD5
f1e8ed93af37fe3f88153a92d7784ba8
-
SHA1
60d4ddbc863a1306467a0af140c85953a699923d
-
SHA256
9900239f9711005ebafddb0fa2b6ededfca83125d872e0bf7df03401ea256d80
-
SHA512
79a4c508a1c384012b20ca8ca6a5df4915f427605528d521eb05bfbeb11312e0dfca5ef72a46e7397218341dffa1a6d7fc598bf4f5c0d8f768ad44e0de6f4c46
-
SSDEEP
6144:MmLzS/UleX6mnPHwJnGJIxUNwYCDZnAsWZOXyNzHXKGVjoBgus9e2:lSqkbvgiIKmYCDK3ZyuzH6Ckgu
Malware Config
Targets
-
-
Target
f1e8ed93af37fe3f88153a92d7784ba8_JaffaCakes118
-
Size
280KB
-
MD5
f1e8ed93af37fe3f88153a92d7784ba8
-
SHA1
60d4ddbc863a1306467a0af140c85953a699923d
-
SHA256
9900239f9711005ebafddb0fa2b6ededfca83125d872e0bf7df03401ea256d80
-
SHA512
79a4c508a1c384012b20ca8ca6a5df4915f427605528d521eb05bfbeb11312e0dfca5ef72a46e7397218341dffa1a6d7fc598bf4f5c0d8f768ad44e0de6f4c46
-
SSDEEP
6144:MmLzS/UleX6mnPHwJnGJIxUNwYCDZnAsWZOXyNzHXKGVjoBgus9e2:lSqkbvgiIKmYCDK3ZyuzH6Ckgu
Score10/10-
Modifies WinLogon for persistence
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-