General

  • Target

    58f0509de53705e530fabdc4eb0e1960_JaffaCakes118

  • Size

    159KB

  • Sample

    241018-xbzb5athkp

  • MD5

    58f0509de53705e530fabdc4eb0e1960

  • SHA1

    b88bd921e9aafd9e64bbf6fd96086ac618a44c18

  • SHA256

    ed961b23b49b7271dce3bf6cd8fdffc9d5c601f1788ebe106d97372f880ca584

  • SHA512

    f933fb7cb846fdf906721da4811ab4976f4233edbd33e98571ab8014a1f2e2fa91bd808dd65298e5006c52dd89b0332fc0b7c796981b52a59b7955b68fe2bf01

  • SSDEEP

    3072:ybl8esLavvrXISBE7y27sDD4aU/W0f73xzodPW0jYQTIZhbLk0:yeeHjX/EH6MaU/WwLxzYPWwNsv

Malware Config

Targets

    • Target

      58f0509de53705e530fabdc4eb0e1960_JaffaCakes118

    • Size

      159KB

    • MD5

      58f0509de53705e530fabdc4eb0e1960

    • SHA1

      b88bd921e9aafd9e64bbf6fd96086ac618a44c18

    • SHA256

      ed961b23b49b7271dce3bf6cd8fdffc9d5c601f1788ebe106d97372f880ca584

    • SHA512

      f933fb7cb846fdf906721da4811ab4976f4233edbd33e98571ab8014a1f2e2fa91bd808dd65298e5006c52dd89b0332fc0b7c796981b52a59b7955b68fe2bf01

    • SSDEEP

      3072:ybl8esLavvrXISBE7y27sDD4aU/W0f73xzodPW0jYQTIZhbLk0:yeeHjX/EH6MaU/WwLxzYPWwNsv

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks