General
-
Target
43b86ada72e178fae04ae847c03948d5_JaffaCakes118
-
Size
190KB
-
Sample
241014-xpf3ps1crf
-
MD5
43b86ada72e178fae04ae847c03948d5
-
SHA1
16053546d522ce37fbaba1de55a8c98fe68edba3
-
SHA256
3bec51e9bacbe530bfe087a3f8b94aa3b71e9c3840da5756f788d1b50b89f674
-
SHA512
8fb2e4f55bee68defc869c28e5e3f47c3c05f2791075e8320143ae6ff42796492c3abb332e3db76a0cb6664631417691d5cb93cb6ca123229d45ac7bbd70c2c5
-
SSDEEP
3072:wLfAbt1dj2pDE6JHvr48gBs+Zaupb3coCeo930ZEj:wLmXqLJPr48g/Zot1
Static task
static1
Behavioral task
behavioral1
Sample
43b86ada72e178fae04ae847c03948d5_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
43b86ada72e178fae04ae847c03948d5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://classicmodels.at:8080/forum/viewtopic.php
http://diva-code.at:8080/forum/viewtopic.php
-
payload_url
http://www.welatec.ch/3K8T5Hu.exe
http://www.acibr.org.br/PATgKq.exe
http://cloudfast.com.br/tjV.exe
Targets
-
-
Target
43b86ada72e178fae04ae847c03948d5_JaffaCakes118
-
Size
190KB
-
MD5
43b86ada72e178fae04ae847c03948d5
-
SHA1
16053546d522ce37fbaba1de55a8c98fe68edba3
-
SHA256
3bec51e9bacbe530bfe087a3f8b94aa3b71e9c3840da5756f788d1b50b89f674
-
SHA512
8fb2e4f55bee68defc869c28e5e3f47c3c05f2791075e8320143ae6ff42796492c3abb332e3db76a0cb6664631417691d5cb93cb6ca123229d45ac7bbd70c2c5
-
SSDEEP
3072:wLfAbt1dj2pDE6JHvr48gBs+Zaupb3coCeo930ZEj:wLmXqLJPr48g/Zot1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-