General
-
Target
4994a9999d8f4230cc80fca302e9f0e0_JaffaCakes118
-
Size
94KB
-
Sample
241015-x3rrcssdla
-
MD5
4994a9999d8f4230cc80fca302e9f0e0
-
SHA1
7c87bdc263a1737b1673805a5789cae768f4d8ae
-
SHA256
32c11b5a672d3934ed340ceaf09ce8d8a45cc6334468fff0dbb4f455fcddec77
-
SHA512
abf703ff41b2068db90870a9e05bab5e81cb84fc2a9c8ca4a52237ae22e1f3cfb919f4fe9d3d41c152eb5298a69b6ed47dbb4a298aa7b2e850348ac3f23ac938
-
SSDEEP
1536:xq7Ng88hoJrQCNH1an5f6wsMvjvC46uhwAd8zLfnQfaEWuXH7l60m:xq7NgbhopTH1an5f6wXvj646KdkfRVqo
Static task
static1
Behavioral task
behavioral1
Sample
4994a9999d8f4230cc80fca302e9f0e0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4994a9999d8f4230cc80fca302e9f0e0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://mtfksui.pw:4915/way/like.php
http://ghkeoud.pw:4915/way/like.php
Targets
-
-
Target
4994a9999d8f4230cc80fca302e9f0e0_JaffaCakes118
-
Size
94KB
-
MD5
4994a9999d8f4230cc80fca302e9f0e0
-
SHA1
7c87bdc263a1737b1673805a5789cae768f4d8ae
-
SHA256
32c11b5a672d3934ed340ceaf09ce8d8a45cc6334468fff0dbb4f455fcddec77
-
SHA512
abf703ff41b2068db90870a9e05bab5e81cb84fc2a9c8ca4a52237ae22e1f3cfb919f4fe9d3d41c152eb5298a69b6ed47dbb4a298aa7b2e850348ac3f23ac938
-
SSDEEP
1536:xq7Ng88hoJrQCNH1an5f6wsMvjvC46uhwAd8zLfnQfaEWuXH7l60m:xq7NgbhopTH1an5f6wXvj646KdkfRVqo
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Hide Artifacts: Hidden Files and Directories
-